Home / Knowledge hub / Chain of custody
Knowledge hub
Chain of custody
A record of who handled evidence, so it can be trusted later.
What it means
Chain of custody is the documented trail of who collected a piece of evidence, who held it afterwards, when it moved, and why. NIST describes it as tracking evidence through its collection, safeguarding and analysis, with each handler, date and purpose recorded.
For digital evidence, such as a disk image or a log export, the trail also proves that the content has not changed. A hash recorded at the moment of collection can be compared later: if the two match, the data is the same.
Why it matters
Evidence that cannot be trusted is of little use. If a log file passed through five hands with no record, an opposing lawyer, an insurer or a regulator can fairly ask whether it was altered. The facts may be perfectly true and still fail to persuade anyone.
It matters when an incident could lead to a dispute: an insider case, a claim against a supplier, an insurance payout or a criminal complaint. You often do not know on day one which of these it will be, so it is cheaper to handle evidence carefully from the start.
How it shows up
In practice it is a simple form or log: item description, where and how it was collected, who by, a cryptographic hash, where it is stored, and each transfer. Store originals read-only and work on copies. Limit who can reach the evidence store, and log access to it. This fits with digital forensics work.
It breaks in ordinary ways: an engineer copies logs to a laptop "to take a look", the original is overwritten, nobody noted the time zone, or a file is renamed. Brief the whole response team early. If the only copy of a log is the one you are editing, you have already weakened it.
Questions people ask
Chain of custody, answered
Why does chain of custody matter for digital evidence?
Digital data is easy to copy and easy to change without a trace. A record of every hand and a matching hash show that what you present is what was collected.
Without it, the evidence may be challenged or excluded.
What is a hash used for here?
A hash is a fingerprint of the data. Take one when you collect the file, record it, and compute it again later. If both values are the same, the file has not changed.
Use a standard algorithm, and note which one.
Do we need it for every incident?
Not always in full. For routine events, good logs are enough. For incidents that may involve legal action, regulators or insurers, follow it properly from the start.
If in doubt, assume it will be needed.
Who should hold the evidence?
A small, named group with restricted access, using a storage location that records who opens what. Avoid personal devices and shared drives.
Keep the original sealed and let analysts work on copies.
Is a chain of custody form enough on its own?
No. It records handling but does not secure the data. You also need access controls, read-only storage and good timestamps.
The form and the controls support each other.
Related
Terms that sit next to this one
Digital forensics
Collecting and studying evidence from systems to learn what happened.
Incident response
The agreed plan for the hours after something has gone wrong.
Audit log
A record of who did what and when, kept so you can answer later.
Hashing
A one-way transformation, so a password can be checked but never read back.
Log retention
How long you keep logs, which decides whether you can investigate old incidents.
Can your evidence be trusted later?
Each of our findings records the request, the response and the code involved, so what you hold is a repeatable record rather than an opinion. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.