Chain of Custody
Also known as: evidence chain of custody, forensic chain of custody, digital chain of custody
Chain of custody is a chronological, unbroken record that documents every person who has accessed, handled, transferred, or modified a piece of evidence or data from the moment it was collected to its final disposition.
In security and forensics, maintaining chain of custody ensures that evidence cannot be challenged on the grounds of tampering or mishandling: a break in the chain can make digital evidence inadmissible in legal proceedings. The concept applies equally to physical evidence, digital artefacts, and sensitive business records.
Chain of Custody, explained at three levels
At home
Chain of custody is the paper trail for evidence. If a company discovers a laptop was used in a fraud and hands it to the police, the chain of custody document tracks who took it, at what time, how it was packaged, who transported it, who opened it in a lab, and every step after that. If this record has a gap (say someone opened the packaging without signing for it) a defence lawyer can argue the evidence could have been tampered with and get it thrown out.
At work
Chain of custody matters whenever you need to prove that data or evidence has not been altered after collection. In a corporate investigation, it means documenting who accessed the server logs, who copied them, how the copies were stored, and who has handled them since. In regulated industries, auditors may ask for chain of custody records to verify that evidence supporting a compliance claim has not been manipulated. The documentation typically includes timestamps, signatures, storage locations, and methods of transfer.
At home
In digital forensics, chain of custody is maintained by creating a cryptographic hash (typically MD5 or SHA-256) of digital evidence at the moment of collection. Any subsequent copy of that evidence can be verified against the original hash: if the hashes match, the data has not been altered. The chain of custody log records every person who accessed the evidence container, the hash verification at each handoff, and the storage conditions (encrypted, access-controlled, physically secured).
At work
Chain of custody documentation for digital evidence typically includes: the date, time, and location of evidence collection; the identity of the person who collected it; the method of collection and the tools used; a hash value of the original data; the storage medium used and its identifier; every person who subsequently accessed the evidence, with date/time and purpose; and the final disposition (destruction, return, or archival). ISO/IEC 27037 provides internationally recognized guidance for collecting and preserving digital evidence.
At home
eDiscovery processes (the legal requirement to produce electronically stored information in litigation) rely heavily on chain of custody. Legal hold notices freeze relevant data, and the chain of custody record documents that the preserved data has not been altered between the hold date and production. Courts have imposed sanctions, including adverse inference instructions (telling juries they can assume the missing evidence would have hurt the party that lost it), for broken chains of custody in civil litigation.
At work
From a practitioner standpoint, the most common chain of custody failure is informal evidence handling: a security analyst copies logs to a personal folder, makes modifications for convenience, and does not document any of it. If the incident later becomes the subject of litigation or a regulatory investigation, the evidence is compromised. Forensic readiness planning establishes chain of custody procedures before incidents occur: designating authorized evidence handlers, pre-approving forensic imaging tools, and maintaining tamper-evident storage. Incident response playbooks should include chain of custody templates that investigators fill in from the moment they first touch potentially relevant evidence.
Real-world examples
At home
Thomas discovered that a former employee had accessed confidential files without authorization before resigning. When he called in a digital forensics company to investigate, they immediately created verified disk images of the relevant devices, generated SHA-256 hashes, and started a chain of custody log: ensuring that anything found could be used in legal proceedings.
At work
The incident response team at Meridian Financial discovered a potential data exfiltration event. Following their forensic readiness playbook, they preserved log files using write-blocker hardware, computed SHA-256 hashes before and after every copy, and maintained a signed chain of custody log throughout the investigation, which later proved critical when the case was referred to law enforcement.
Common confusions
- Chain of custody is not just for criminal investigations. Any situation where evidence might later be needed to prove a fact in a legal or regulatory context (an employment tribunal, a civil lawsuit, a regulatory audit) requires chain of custody practices. A poorly documented internal investigation can create legal problems even when the underlying facts support the company's position.
- Creating a forensic copy of data is not the same as preserving chain of custody. A copy made without documenting who made it, what tools were used, and whether the hash was verified does not constitute a maintained chain of custody. The documentation process is as important as the technical steps.
- Chain of custody applies to ongoing data handling, not just incident response. Sensitive records held for compliance purposes (audit logs, contracts, financial records) should have access controls and access logs sufficient to demonstrate that the records have not been altered since they were created. This is chain of custody at the records management level.
For analysts
In BA artefacts, chain of custody requirements typically appear in systems that capture audit-critical or legally sensitive data: transaction logs, access records, digital contracts, and compliance evidence. When documenting requirements for such systems, specify that data must be immutable (write-once or append-only), that access to records must itself be logged, and that hash verification must be available. Useful NFR: 'Audit log records must be write-protected after creation, with access logs capturing every read of a compliance record, to support chain of custody verification in regulatory investigations.'
History & origin
Chain of custody originated in criminal law, where courts required proof that physical evidence presented at trial had not been contaminated or altered since collection. The concept was formalized through US Federal Rules of Evidence and equivalent rules in other jurisdictions. As computers became central to criminal investigations in the 1980s and 1990s, chain of custody requirements extended to digital evidence: requiring investigators to document every access to a disk image, memory dump, or log file. Today, chain of custody is also a requirement in regulatory frameworks like PCI DSS (for security incident evidence), eDiscovery processes, and ISO/IEC 27037 (digital evidence collection guidelines).