Three Days in an Unlocked Drawer: A Chain-of-Custody Gap

• iPhone - low risk. Imaged at intake, hashed the same day, logged immediately. That is a defensible chain: a hash at intake plus a hash later proves the image is unchanged, and the custodian can testify to the sequence. The tool's own audit log supports it.
• USB drive - high risk, and it is the weakest link. The problem is not that anything bad happened; it is that nothing in the record shows it did not. A three-day gap, an unlocked drawer, two people with access, no intake hash, and a label date that differs from the receipt date means the drive cannot be uniquely identified as the object that arrived. Opposing counsel will argue substitution or alteration, and you have no document to answer with. An unbroken chain is the point of the chain.
• Derivative-status problem - applies to all 300. Screenshots are copies of copies. The original messages live on a device or in a cloud account, so best-evidence and authentication questions attach to the source, not to the drive.

Ranking rationale: risk here is a function of what your documentation can prove, not of what you believe happened. The phone is documented; the drive is not; the screenshots inherit the drive's weakness and add an authenticity problem of their own.

Fix the record going forward and never repair it backward.

1. Write a memo to file today describing the three-day gap, the drawer, who had access, and why no hash was taken at intake. Date it accurately. Do not backdate, re-label, or create a chain-of-custody form that implies continuous custody.
2. Hash the drive now and document it, with the time and the person. A late hash is worth something; a fabricated early one is worth nothing and ends careers.
3. Interview the two staff members and get signed statements that neither removed, copied, or handled the drive. That is the only evidence that can close the gap.
4. Re-bag and seal with a new custodian log, and adopt a rule that nothing enters the office without a hash and a signature at the door.
5. Preserve the source. Ask the client in writing not to delete, reset, or 'clean' the family computer. If the client controls it, arrange a forensic image or at least a documented inspection.
6. Get the client's written account of exactly how the screenshots were made - who held whose phone, whether they were texted, emailed, or re-photographed.
7. Pursue the stronger source. Records directly from the carrier or the messaging platform beat screenshots; discuss with counsel well before the 11-week deadline, because these requests take time.

Tell counsel about the gap in writing now. A surprise at deposition is worse than an admitted weakness.

There are innocent explanations - a screenshot can carry a save date from a later re-opening, a forward, a migration, or a re-save of an image - and there are bad ones. Neither can be assumed.

• Separate them from the other 210 and analyze the pattern: are all 90 from one device, one date range, one conversation, or one file type? Uniformity of anomaly is itself information.
• Ask the client for a specific, checkable explanation and document the answer verbatim, including 'I don't know.'
• Do not silently drop them to make the exhibit cleaner. Selective omission of unfavorable material is exactly the conduct that turns a records problem into an ethics and discovery problem.
• Disclose them in the report with the metadata finding and the client's explanation, and let counsel make the tactical call on use.
• If the anomaly cannot be explained, recommend that the exhibit rely only on the consistent items, with the 90 listed and flagged rather than deleted.
• Never adjust metadata, re-save files to change dates, or describe the 300 as a uniform set.