Chain of Custody for Digital Evidence: A Practical Guide

A physical exhibit in a sealed bag is difficult to alter without visible evidence. A file is trivially alterable, copies are indistinguishable from originals, and modification leaves no physical trace.

Custody documentation designed for physical evidence — a form recording transfers between named officers — carries over the continuity requirement but not the integrity one. It records who had the file. It does not establish that the file is unchanged, and that is the question that will be asked.

The mechanism is straightforward. On acquisition, compute a cryptographic hash of the exhibit and record it. Any subsequent modification, however small, produces a completely different hash.

The part that is often skipped is re-verification. A hash recorded once at intake and never checked again demonstrates only what was true at intake. Re-computing it before each examination, and recording that it matched, establishes integrity across the whole handling period.

This also produces the right behaviour on failure. If a re-verification does not match, the correct response is to refuse the examination and record the discrepancy — the mismatch is itself a finding, and proceeding would produce a result about an exhibit that is not the one seized.

A custody log is a claim about history, and a conventional log — even one in a database with restricted access — can be edited by anyone with sufficient privilege. "Our access controls prevent that" is a weaker statement than it sounds under challenge.

Hash-chaining fixes this. Each entry includes the hash of its predecessor, so entries form a linked sequence. Altering or removing any entry changes its hash, which breaks every link after it — detectably, and at an identifiable point.

The practical consequence is that the log can be re-walked and verified rather than trusted. That converts an assertion into something demonstrable.

A custody entry that answers the questions actually asked:

The instinct to remove an erroneous or superseded record should be resisted entirely. Deletion destroys the audit trail and invites the question of what else was removed — a question with no good answer once the capability exists.

The better model is that records are added, never removed. An exhibit entered in error is marked as such, with a reason and a named officer, and retained. A re-examination adds a result rather than replacing one. A corrected finding supersedes rather than overwrites.

This also handles disclosure cleanly: earlier examinations and discarded results are potentially disclosable, and a system that overwrote them cannot produce what it no longer has.

In practice, the failures cluster in a few places. Media forwarded through a messaging application before it is formally seized, so the examined copy is already several re-encodings from the original. Exhibits copied to a working directory and examined there, with the working copy diverging from the sealed one. Shared accounts, so entries cannot be attributed to an individual. And gaps between seizure and intake where nothing was recorded because nothing seemed to be happening.

Each is avoidable with process rather than technology, but each is much easier to avoid when the system makes the correct action the default — sealing on intake, examining the sealed original read-only, and requiring an authenticated named account for every action.