Chain of Custody: Documentation That Survives a Legal Challenge

Chain of custody is the documented history of a piece of evidence: who had it, when, and what they did with it, from collection until it is presented. It exists to answer one question a defense attorney will certainly ask — can you prove this is the same data you seized, unaltered?

If the answer is no, the evidence may be excluded regardless of what it contains. That outcome is the reason the paperwork matters.

What the Record Must Contain

Every entry documents a transfer or an action:

• Description of the item — make, model, serial number, capacity, distinguishing marks. "One laptop" is not a description.
• Who collected it, with date, time including time zone, and physical location.
• Cryptographic hash of the acquired image, recorded at acquisition.
• Every transfer — who released, who received, when, and why.
• Every examination — who accessed it, what was done, what tools were used.
• Storage conditions between transfers — which safe, which locker, who holds the key.

The principle behind all of it is that there can be no unexplained gaps. A period where nobody signed for the item is a period where the opposing party can argue anything might have happened.

Hashing Is the Technical Backbone

The paperwork establishes custody; the hash establishes integrity. Hash the original media before imaging where possible, hash the image after acquisition, and confirm they match. Re-verify the hash before and after every examination.

Analysis is performed on a working copy, never the original. The original goes into secure storage and stays there. If a working copy is damaged, another is made from the verified image.

Write blockers — hardware devices that permit reads and physically prevent writes — are what stop the acquisition process itself from altering the source. Simply mounting a drive on a running system can update access timestamps, which is enough to undermine the claim that nothing changed.

Two hash-related points worth knowing: older algorithms have demonstrated collision weaknesses, which is why current practice records SHA-256 (frequently alongside MD5 for tool compatibility), and a hash mismatch must be documented rather than quietly re-run. Failing media produces genuine mismatches, and the honest record of that is more defensible than a clean record that cannot be reproduced. The broader algorithm considerations sit in cryptographic vulnerabilities.

Collection Order

What you collect first is determined by what disappears fastest. Memory contents, network connections and running processes are gone at shutdown; disk survives. Working through evidence in the right sequence is covered in the order of volatility, and getting it wrong destroys evidence in a way no documentation can repair.

Where Chains Break

The failures are mundane, which is exactly why they recur:

• Evidence left on a desk overnight, unsigned and unsecured
• A responder powering on a machine "just to check something" before imaging
• Time zones unrecorded, so a timeline cannot be reconciled across systems
• A transfer made verbally and documented later from memory
• Cloud evidence collected with no record of which account, which region, or what API call was used
• Shared storage where several people hold keys and no one signs in or out

Cloud and remote evidence deserve particular care. You are collecting from infrastructure you do not control, so document the provider, the account, the collection method, the timestamps the provider supplied and the timestamps your tooling recorded. Where legal process is involved, the provider's own attestation becomes part of the record. These requirements overlap heavily with the e-discovery process, and the two workflows should not be run as if they were unrelated.

Related Legal Obligations

A legal hold suspends routine deletion the moment litigation is reasonably anticipated — before evidence is collected, not after. Retention schedules stop applying to held data, and continuing to run an automated purge across it is spoliation.

Know also who may collect what. Internal teams handle internal systems; anything crossing into a criminal matter or another organization's infrastructure needs legal guidance first. The escalation path belongs in the incident response playbook rather than being improvised at two in the morning.

Exam Focus

Expect chain of custody as the answer whenever a scenario mentions evidence that may be used in court or in disciplinary action. Know that hashing proves integrity while documentation proves custody — they are separate requirements and both are needed. Know that analysis happens on a copy, that write blockers prevent modification during acquisition, and that a gap in the record is the specific weakness that gets evidence challenged.

The useful mental model: assume every action will be questioned by someone hostile, a year from now, when you no longer remember the details. Write accordingly.