Chain of custody (digital evidence)
The documented record of who collected, held, transferred and examined an item of digital evidence, from the moment it was identified to the moment it is presented or returned.
Reviewed by the ITRS security team · Last updated
Definition
Chain of custody is the documented record of who handled a piece of digital evidence, when, and why. NIST defines it as a process that tracks evidence through collection, safeguarding and analysis by recording each person who handled it, the date and time it was collected or transferred, and the purpose of each transfer. Gaps invite challenges in court.
Chain of custody is the continuous, written record of an item of evidence's handling. For digital evidence the 'item' may be a physical device such as a laptop or phone, a forensic image of that device, or an export from a cloud service such as a mailbox or SharePoint site. The record shows who had it, when, where it was kept, what was done to it, and how its integrity was verified at each step.
ISO/IEC 27037, the international guideline on identifying, collecting, acquiring and preserving digital evidence, and NIST SP 800-86 both treat documentation of evidence handling as a core part of forensic practice.
Why it matters in court
Digital evidence is easy to change and the change is not visible to the eye. A court asked to rely on it will want to know that what is presented is the same as what was collected. Under the Canada Evidence Act (sections 31.1 to 31.3) and section 34.1 of Ontario's Evidence Act, the party introducing an electronic record must authenticate it, and the best evidence rule turns on the integrity of the record or the system that stored it. A clean chain of custody, together with matching hash values, is direct evidence of that integrity.
A weak chain does not automatically make evidence inadmissible, but it gives the other side room to argue about weight, and it can turn a technical question into a credibility contest.
What the record contains
| Field | Purpose |
|---|---|
Unique evidence ID | Ties every note, image and report to one item |
Description | Make, model, serial number, capacity; or account, tenant and data type for cloud exports |
Source and owner | Where it came from and who it belongs to or was used by |
Date, time and time zone of collection | Establishes when custody began |
Collected by | Name and organization of the person who collected it |
Method and tool | How it was acquired (write-blocked image, logical extraction, eDiscovery export) and tool versions |
Hash values | Algorithm and value at acquisition, and at each later verification |
Transfer log | Each hand-over: from whom, to whom, date, time, reason, signatures |
Storage location | Where the item and copies are stored and how they are secured |
Final disposition | Returned, retained or destroyed, when and by whom |
Common breaks
- A device examined by internal IT 'to have a look' before forensic collection, with no record of what was done
- Evidence shipped or handed over without a signed transfer entry
- No hash value at collection, so later integrity cannot be demonstrated
- Hash values recorded, but never re-verified before analysis
- Gaps in time with no record of where the item was
- Original device used for analysis instead of a verified copy
- Emails forwarded or files copied as the 'collection', changing metadata
Cloud evidence and custody
With cloud sources, there is no device to seal in a bag. Custody begins when the data is exported. The record should capture the tenant or account, the admin account used, the exact search or export settings, the export reports produced by the platform (for example Microsoft Purview's item reports or Google Vault export metadata), the download time, and hash values calculated as soon as the package is downloaded.
Where logs and audit records form part of the evidence, record the query used and the retention period that applied, so it is clear what could and could not have been captured.
Template fields
A simple chain-of-custody form can be one page per item. At minimum:
- Matter name and evidence ID
- Item description and identifiers
- Collected from (person, location, account)
- Collected by, date, time and time zone
- Acquisition method and tool version
- Hash algorithm and value (acquisition)
- Transfer table: released by, received by, date/time, purpose, signatures
- Verification table: date, hash value, matches (yes/no), verified by
- Storage location and access restrictions
- Disposition and date
Related.
- HubCyber, forensics, privacy and legal-tech glossaryPlain-English definitions of the terms used across this site, from BEC and chain of custody to RROSH, DMARC and legal holds, with links to the pages that go deeper.
- GlossaryHash values and forensic imagesA plain-language explanation for lawyers, HR and managers of what a hash value is, how a forensic image differs from a copy, and how to read the hash references in a…
- ServiceDigital forensics in Toronto: computers, phones, Microsoft 365 and Google WorkspaceIT Rapid Support provides digital and computer forensics services for businesses in Toronto, the GTA and Ontario, focused on Microsoft 365, Exchange Online and Google…
- ServiceeDiscovery and defensible collectionProportionate, documented collection of email, chat, files and phone data for small and mid-sized matters, done so that how it was gathered never becomes the argument.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.