Glossary
Chain of custody
Chain of custody documents the possession, transfer and handling of evidence from acquisition through use.
Provenance and citation
Chain of custody is an account of who held evidence, when it changed hands and what happened to it. Its purpose is to support confidence that material presented later is the material originally acquired, or to make any changes visible. The required detail depends on the stakes and setting. A chain can cover digital files as well as physical objects.
For digital evidence, a practical record includes acquisition context, custodians, access or transfer events and integrity checks where appropriate. A cryptographic hash can show that two byte sequences match; it cannot show that the original source was truthful. Conversions such as OCR or format changes should be recorded as derived objects, with the original preserved where lawful and feasible.
An organization defending a decision may need to demonstrate that the cited evidence was not silently altered after collection. Chain of custody addresses that handling question. Provenance is broader and includes derivations and responsible actors; a retained source copy is the material being preserved; an audit trail records actions but may lack the evidentiary context required here.
Example
A Halden Therapeutics AG (fictional) filing is acquired, hashed and reviewed; the record notes a later OCR copy as a derivative of the original file.
What the record has to show
The NIST glossary defines chain of custody as a process that tracks the movement of evidence through its collection, safeguarding and analysis by documenting each person who handled it, the date and time of collection or transfer, and the purpose of the transfer. For digital evidence the same logic applies, with the added problem that copying is trivial and leaves no physical trace. NIST's report on digital evidence preservation sets out considerations for those who handle digital evidence, including documenting actions and verifying integrity with hashes, and the guide to forensic techniques in incident response treats collection, examination and the preservation of integrity as linked steps.
Legal systems frame the purpose. In United States federal courts, Rule 901 of the Federal Rules of Evidence requires the proponent of an item to produce evidence sufficient to support a finding that it is what the proponent claims it is. A documented chain of custody is one way of meeting this requirement. The practice has value outside litigation, since a regulator, an auditor or a client may equally ask whether the evidence behind a decision is what it appears to be.
Mechanisms for digital integrity
Three mechanisms are common. A cryptographic digest taken at the time of collection, and recorded separately from the item, lets anyone later detect a change in the bytes, as discussed under content addressing. A trusted timestamp, such as one issued under the Time-Stamp Protocol in RFC 3161, shows that a digest existed at a particular time. An append-only log of handling events, as in an append-only log, records each access and transfer so that the history cannot be rewritten without detection. None of them proves that the item was authentic when collected; they show that it has not changed since.
Procedures matter as much as mechanisms. Define who may collect and who may access, record each transfer with a reason, store originals read-only and work on copies, and verify digests at each transfer. Test the procedure by sampling items and reconstructing their history from the records alone. If a gap appears, record it and its effect on how far the item can be relied on.
A worked example
A compliance team collects an email export and a registry page as evidence of when Halden Therapeutics AG (fictional) was told of a supply problem. The collector records the time, the method and the SHA-256 digest of each file, and obtains a trusted timestamp for the digests. The files are stored read-only. When an analyst opens an item to extract a passage, the access is logged with the purpose. Six months later, outside counsel asks whether the email export is the one collected in March. The team recomputes the digest, compares it with the recorded value and the timestamp, and produces the access log. The match supports the claim that the file has not changed; the log shows who saw it. What remains outside the chain is whether the export was complete when collected, which is a collection question and is documented separately.
Related terms and boundaries
A chain of custody protects the integrity of a retained source copy and extends the reach of provenance through time and handlers. It is usually implemented with content addressing and an append-only log, and it feeds the audit trail. The article on what a signed RDF export proves examines how far a signature extends the chain and where it stops.
Common misreadings
- Treating a hash as proof that the source claim is true.
- Losing the original after creating a derivative.
- Leaving transfers or corrections undocumented.
Appears in
- Retaining source copies
Preserve the material actually read, subject to rights, and bind its citation with a content digest.
- W3C PROV
A family of specifications for representing provenance of entities, activities, and agents.
References
- W3C (2013), PROV-O: The PROV Ontology.
- NIST Computer Security Resource Center Glossary, chain of custody.
- Guttman, White and Walraven (2022), Digital Evidence Preservation: Considerations for Evidence Handlers, NIST IR 8387.
- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response.
- Federal Rules of Evidence, Rule 901: Authenticating or Identifying Evidence.
- IETF (2001), RFC 3161: Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP).
Found an error on this page? See corrections for what counts as one, how to report it and the dated log.
Enquiry
Where does "Chain of custody" bear on a decision of yours?
This entry sits under provenance and citation. If a decision in your organization turns on it, send the entity concerned, the sources you fuse to describe it and who may read which of them. We reply with what a first record would cover.
Or write to [email protected] in your own words.