Chain of custody

Evidence carries weight only if it can be shown to be the same item and unaltered. Every transfer is therefore recorded: a unique identifier, description, date and time, location, the person taking custody, the purpose and a signature. Tamper-evident packaging and seals are used, and storage is secured with restricted, equally documented access.

For digital evidence, chain of custody rests on hash values: computed at acquisition and re-verified after every step, they demonstrate that the content has not changed. Work is performed on forensic copies while the original remains untouched. The tools used and their versions, the time source and the time zone must be recorded. For volatile data such as memory contents and open connections, the order of collection and the reasons for it must be documented, since the act of collection itself alters the state of the system.

A break in the chain does not automatically make evidence inadmissible, but it weakens its persuasive value and opens the door to claims of tampering. Internal investigations therefore apply the same discipline as criminal proceedings: internal matters frequently continue later as a criminal complaint, a labor dispute or a damages claim, and by then it is too late to correct how the evidence was handled.

Practice is guided by international standards, among them ISO/IEC 27037 for the identification, collection, acquisition and preservation of digital evidence, together with related standards for the investigation process and analysis. The test for adequate documentation is simple: an independent expert must be able to repeat the steps and arrive at the same result.