Chain of custody records

Evidence is only as trustworthy as its history. The chain of custody is the documented, unbroken record of who had an item, when, where, why and in what condition, from the moment it was collected until it is returned or destroyed. This lesson explains what a custody record contains, how it applies to digital copies as well as to physical devices, how seals and electronic systems support it, and what to do when something goes wrong. Seizure and packaging are covered in Module 3, and the hash values that show a copy is unchanged in Module 4.

Why the chain must be unbroken

A court, an opposing expert or an auditor will ask two questions about any exhibit: is this the same item that was collected, and could anyone have changed it since? The chain of custody answers both. Each person who had control of the item is a link, and each transfer between them is recorded. A gap, such as a day when nobody can say where a phone was, does not prove that anything was altered, but it removes the proof that nothing was. Depending on the legal system and the circumstances, a gap may reduce the weight given to the evidence, force witnesses to explain it at length, or lead to the evidence being excluded.

The chain of custody is what makes the auditability described in Module 1 possible: an independent person should be able to trace every movement of every item from the records alone, without relying on anyone's memory.

What a custody record contains

Forms differ between organizations, but a complete record holds two kinds of information: a description of the item, written once, and an entry for every transfer.

• Unique identifier: an exhibit or item number that appears on the item, its packaging, the notes, any images made from it and the report.
• Description: type of item, make, model and serial number, plus distinguishing marks such as damage, stickers or an asset tag.
• Collection details: where and when it was collected, by whom, and under which authorization or case reference.
• Each transfer: who released it, who received it, the date and time with time zone, and the purpose, such as transport, storage, examination or production in court.
• Condition and seal status at each transfer: the seal number, whether it was intact, and any change to the item's condition.
• Signatures of both the person releasing the item and the person receiving it.

Storage counts as custody. While an item sits in an evidence store, the custodian responsible for the store is its holder, and every check-out and return is a transfer.

Seals and seal numbers

A tamper-evident seal is a label, tape or bag closure that cannot be removed without visible damage. Most carry a unique printed number. The seal number is written in the custody record and in the notes, so that anyone receiving the item can check that the same seal is still in place and intact. Seals do not prevent tampering; they make it visible.

When an examiner needs the item, they open the package themselves, record that they did so, and reseal it afterwards with a new seal whose number is also recorded. Writing initials and the date across the seal and the packaging adds a further check. A seal is never reused.

Physical items and digital copies

Custody does not end with the device. A forensic image is evidence too, and it is usually the evidence that is actually examined. Each image, export or set of extracted files needs its own record:

• The identifier of the source item and a separate identifier for the copy.
• The hash values calculated at acquisition, so that any later copy can be verified against them.
• Every copy made: when, by whom, onto which media or storage location, and for what purpose.
• Who accessed each copy, and when it was deleted or destroyed.

Media that hold evidence copies, such as external drives used to carry images, are tracked as items in their own right, with serial numbers and custody entries.

Electronic custody systems

Many laboratories and organizations record custody in software rather than on paper: a case management system, a laboratory information management system (LIMS) or a dedicated digital evidence management system. Items carry barcode or RFID labels that are scanned at each transfer. The advantages are legible entries, consistent fields and an audit log: an automatic, time-stamped record of every action, such as viewing, checking out, downloading or changing an entry, linked to an individual user account.

An electronic system is only as good as its controls. Each person needs their own account, the audit log must be protected from editing, the system clock must be accurate, and corrections must be added as new entries rather than overwriting old ones. Where a paper form also travels with the item, the two records must agree.

When something goes wrong

Mistakes happen: a seal arrives torn, a signature is missing, a time was written in the wrong time zone. The rule is to document honestly, never fix silently.

• Record what you found, when, and who was present; photograph a damaged seal or package before doing anything else.
• Report the problem to the person responsible for the case.
• Add a dated correction or explanation. Never back-date an entry, erase one, or ask someone to sign for a transfer they did not witness.
• Where a verified image already exists, a new hash of the original can show whether the data on it has changed since acquisition.

A problem that is disclosed and explained can usually be dealt with. A concealed one that comes out under cross-examination damages the examiner's credibility far more than the original mistake.

A worked example: from seizure to court

Ana Ruiz, an investigator for a fictional logistics company, collects a laptop from an employee's desk under an internal investigation authorization. She records the make, model and serial number, assigns exhibit number LT-01, packs the laptop in an evidence bag and closes it with seal S-104. The record then grows with each hand-off:

Each line is signed by both people. Alongside it, the image LT-01-IMG has its own record: its SHA-256 value at acquisition, the master copy on the laboratory's evidence server, and one working copy issued to M. Lind and later deleted with authorization. At the hearing, Ana can show that the laptop in court is LT-01 and that its history has no gaps, and M. Lind can show that the image she analyzed matches the acquisition hash.

Exam focus: Know what a chain of custody record contains: unique identifier, description with serial number, collection details, and for each transfer the people releasing and receiving, date and time, purpose, seal number and condition, and signatures. Remember that storage check-outs are transfers and that forensic images and their copies need custody records too. Expect scenarios about broken seals, missing signatures and gaps: document and explain honestly, never correct silently or back-date.