Chain of custody is the documented history of evidence handling. For digital material, it should show the source, collection, transfers, storage and examination actions in enough detail that another person can understand how the evidence was managed.
Identify the item precisely
Record make, model, serial number, asset tag, account identifier, storage location or other details that distinguish the evidence from similar items. Photographs may also help document physical condition and packaging.
Record every transfer
Each handover should record who released the item, who received it, the date and time, and the reason for the transfer. Avoid undocumented informal movement of evidence.
Document acquisition and copies
Where forensic images or exports are created, record the method, resulting files, integrity checks and where working copies are stored.
Keep the record with the case
Custody records should remain accessible with the case material so handling can be explained months or years later if required.
- Unique device or evidence identifiers
- Collection date, time and collector
- Packaging or seal details
- Every handover and storage location
- Acquisition notes and hash values
- Examiner actions relevant to integrity
- Using vague labels such as “phone 1” without identifiers
- Moving evidence without recording the transfer
- Working directly on the only original copy where avoidable
- Keeping custody notes in personal notebooks disconnected from the case