Simple definition
Chain of custody records who collects, holds, transfers and examines evidence, together with the timing and conditions of each operation.
Purpose and use
It provides a trace of handling that supports the integrity and provenance of material used in an investigation.
How does it work?
Each device or acquisition receives an identifier. Transfers, access, copying methods and hashes are recorded; analysis should use a controlled copy where possible.
Key points
- Example: a disk image is identified and hashed, and each handover to another investigator is documented.
- Check that identifiers, hashes and timestamps agree, allowing for time zones and system clock synchronization.
Points to watch
A hash alone does not establish a file’s origin or its complete history. Evidence-handling requirements depend on the investigation context.
In short
Chain of custody makes the path of evidence traceable and explains how it was handled.