Chain of Custody: The Thread That Holds Digital Evidence Together
A hash proves a file has not changed. The chain of custody proves who had it, when, and why. Lose the thread and the evidence unravels.
Ask most people what makes digital evidence reliable and they will mention hashing. Hashing is necessary but it is not sufficient. A hash tells the court that a file is identical to one certified on a given day; it says nothing about where that file came from, who handled it, or whether the certified copy was itself genuine. That story is told by the chain of custody.
What the chain records
A chain of custody is a contemporaneous log of every person who possessed an item of evidence and every action taken with it, from the moment of collection until it is produced in court. For digital material the item may be a physical device, a storage medium or a file, and often all three at different stages.
- Who collected the evidence, from where, and under what authority.
- A unique identifier for each item and the hash of each digital artefact.
- Every transfer: who handed it over, who received it, when, and for what purpose.
- Storage conditions, including access controls and any seals applied or broken.
- Every examination performed, with the tool, version and resulting outputs.
Where chains break
In our review of contested matters, chains almost never break during forensic examination. They break at the edges: a phone that sat in a drawer for three weeks before anyone logged it, a USB drive copied by a junior who did not record the step, or an image file emailed to counsel without a hash.
"Courts do not demand perfection in custody. They demand an honest account. A gap that is documented and explained is rarely fatal; a gap that is discovered in cross-examination usually is."
Building a chain that survives scrutiny
Record at the point of action
A log written from memory the following week is worth very little. Each entry should be made at the time of the action, by the person performing it, and should be impossible to alter silently afterwards. Evidify's custody log is append-only and each entry is hashed together with the previous one, so any retrospective edit is immediately detectable.
Separate the working copy from the original
Examination should always take place on a verified copy. The original device or image is sealed, its hash recorded, and it is touched again only to produce a fresh copy or to be presented in court. This single habit eliminates most spoliation allegations.
Make the chain readable
A chain of custody is written for a judge, not a database. Present it as a chronological table with plain-language descriptions of each action. Technical detail belongs in an annexure that can be reached from the table.
Integrity and custody are two halves of the same proof. Hashing shows that the evidence has not changed; the chain of custody shows that the thing which has not changed is the thing that was actually collected. Courts need both, and they need them before the hearing begins.