Chain of Custody and Documentation
Chain of Custody and Documentation
This domain tests continuity of evidence and the records that make it credible. Chain of custody is not a single form; it is an unbroken, contemporaneous account of possession, handling, and storage.
Core rules
- Each item gets a unique identifier, description, serial number, capacity, hash, collector, date/time, location, and seal status.
- Every transfer records from whom, to whom, date/time, purpose, and signatures. Gaps invite challenge.
- Use tamper-evident bags and seals; write initials and dates across the seal; reseal with a new entry when opened.
- Keep contemporaneous notes of actions, tool versions, commands, observations, errors, and deviations from procedure. Notes should be made at the time, not reconstructed later.
- Photograph packaging and seals; store evidence in controlled, access-limited environments.
Worked example
A USB drive is collected, hashed, and sealed. Later the examiner opens it for imaging. The chain form records the seal break, new seal number, date/time, and purpose. The image hash matches the earlier hash. If the seal were broken without an entry, the defense could argue tampering even if the data are unchanged. Continuity is proven by records, not by intent.
Traps
Backdating entries; signing for another person; photocopying a chain form and calling it an original record; leaving time gaps; failing to document tool errors or procedural deviations; writing notes days later from memory.
Key points
- Chain of custody proves uninterrupted possession and handling.
- Every transfer needs time, purpose, and signatures.
- Tamper-evident seals must be documented when broken and replaced.
- Contemporaneous notes should record actions, tools, errors, and deviations.
- Records must let an independent examiner reconstruct the handling.