Digital evidence chain of custody: an operational checklist
An operational checklist for identifying, acquiring, preserving, transferring, examining, and disposing of digital evidence.
Digital files are easy to copy, transform, and separate from their context. A defensible chain of custody therefore depends on disciplined documentation, preservation, access control, and reproducible handling—not on a single form completed at collection.
Key takeaways
- Document who collected what, from where, when, how, and under what authority.
- Protect originals and record integrity checks appropriate to the evidence and procedure.
- Log every transfer, examination, derivative, exception, and final disposition.
Identify before you acquire
Assign a unique evidence identifier and describe the item or data source precisely enough that it cannot be confused with another. Record the case identifier, custodian or source, collection location, device or account details, date and time, collector, authority, and the condition or state observed before acquisition.
Plan for volatile or remotely changeable data. The order of collection can affect what remains available, so the collection method should be chosen and documented by a competent person under the applicable authority and procedure.
Preserve integrity and context
Retain an original or preservation copy according to the governing procedure and conduct examination on controlled working copies where appropriate. Record the acquisition tool, relevant settings, output, errors, and any unavoidable changes. A cryptographic hash can help demonstrate whether a digital object has changed, but it does not replace provenance, access records, or competent handling.
- Record integrity values separately from the evidence object
- Use approved algorithms and tools appropriate to the environment
- Protect encryption keys, credentials, and recovery material separately
- Keep original metadata and container information where relevant
- Document failed checks and investigate rather than silently replacing values
Control custody and access
Log each transfer between people, systems, and storage locations. A transfer record should include the evidence identifier, releasing and receiving parties, date and time, purpose, condition, destination, and acknowledgement. System activity logs support this history but should not be assumed to capture the full legal chain automatically.
Apply least-privilege access, individual authentication, protected logging, and environmental controls suited to the evidence. Periodically verify that evidence remains readable, intact, and associated with the correct matter.
Track derivatives and disposition
Exports, transcodes, redactions, screenshots, extracted messages, and analytical datasets are derivatives. Give them their own identifiers, link them to their source, and record the process used to create them. Reports should make clear which version was examined.
At return, transfer, archival, or destruction, verify authority and retention requirements, document the disposition, and preserve the custody record for the required period. Litigation holds, appeals, investigations, and contractual obligations may prevent routine disposal.
What does a digital chain of custody record prove?
A digital chain of custody documents the handling history of an identified item: who collected it, who held or accessed it, what was done, and where it went. It helps a reviewer assess continuity and handling. It does not, by itself, establish whether the information in a message is truthful, whether the account holder wrote it, or whether the collection was legally authorized.
Keep three related questions separate. Provenance concerns where an item came from. Integrity concerns whether the bytes or relevant characteristics changed. Custody concerns who controlled or handled the item. A complete working record connects all three, with the collection authority and examination method available for review.
Example: preserving an email attachment and a working copy
Suppose an investigator receives an authorized mailbox export containing a relevant attachment. Assign identifiers to the export and the attachment, preserve their relationship, and record the collection method and relevant message context. Keep the retained source protected from routine editing. An analyst can then work from a documented copy while the source remains available for independent examination.
If the analyst converts the attachment to PDF or runs OCR to make it searchable, record the new item as a derivative. Link it to the source, identify the tool and operation, and note any conversion limitations. The searchable version may be convenient for review, but the reviewer should still be able to inspect the original format and context.
- Source and derivative identifiers linked to the same case
- Collector, collection time, source location, and authorized scope
- Integrity check method and result where appropriate
- Transfer sender, recipient, time, reason, and acknowledgement
- Examination or conversion operation and resulting item identifier
Is a matching file hash enough for chain of custody?
No. A matching cryptographic hash can support a comparison between two byte sequences using the stated algorithm, but it does not document the whole history of an item. It cannot fill a gap in collection authority, identify an undocumented handler, or prove that the source content was accurate before collection. Record hash values alongside the item identifiers and the circumstances of the check.
When a mismatch or custody gap appears, preserve the affected material, record the discrepancy, and refer it to a competent examiner or responsible reviewer. Avoid silently replacing the earlier value or claiming an uninterrupted history. Whether the issue affects reliance on the evidence depends on the item, explanation, investigation purpose, and applicable procedure.