Chain of Custody
Definition
The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes the hash value of the original media at acquisition, the identity and credentials of each handler, and the integrity checks applied at each transfer. Courts use the chain of custody to assess whether evidence could have been altered after seizure.
- Field
- Evidence management
- Purpose
- Prove evidence integrity
- Recorded on
- Chain-of-custody form / custody log
- Matters when
- Admissibility is challenged
Common questions
What is the chain of custody in forensics?+
It is the documented, unbroken record of everyone who handled a piece of evidence, along with when and how each transfer happened, from collection at the scene to presentation in court. The record exists to show the item was not altered, swapped or contaminated along the way.
Why is the chain of custody important?+
If the chain is broken, the opposing side can argue the evidence may have been tampered with or mixed up, and a court may reduce its weight or rule it inadmissible. An intact chain is what lets a lab result be trusted as belonging to the right case.
What happens if the chain of custody is broken?+
A gap does not automatically discard the evidence, but it gives grounds to challenge its reliability. A court weighs how large the gap is and whether tampering was plausible before deciding how much the evidence should count.
Related terms
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Expert Witness
- A person whose specialised knowledge is accepted by a court and who gives opinion evidence, not just factual evidence. Forensic auditors frequently...
- Admissibility
- Whether a piece of evidence is permitted to be placed before the fact-finder at all. Admissibility is a threshold question, decided by...
- Authentication
- The process of establishing that a document is what it purports to be. Under the US FRE Rule 901, the proponent must...
- Daubert Standard
- The US federal evidentiary standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) requiring that expert testimony be based on scientifically valid methods with...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Legal Hold
- A directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant...
- Mutual Legal Assistance Treaty (MLAT)
- A bilateral or multilateral treaty under which signatory states agree to assist each other in gathering evidence for criminal investigations. MLATs define...
- Reference Sample
- A biological sample collected from a known individual (victim, suspect, or elimination source) for comparison against scene stains. Typically a buccal swab...
- Tamper-Evident Seal
- A physical barrier (tape, sticker, wax) applied to packaging that shows visible damage if the package has been opened after sealing. Courts...
- Alternate Light Source (ALS)
- A device emitting light at selected wavelengths (typically 415 to 535 nm) used to detect biological fluids that fluoresce or absorb light...
Explained in these topics
- Accreditation and Quality Systems in Wildlife ForensicsThe documented chronological record of who collected, handled, transferred, and analysed an item of evidence. For biological specimens, must also record storag...
- Arms, Explosives and Firearms LawThe documented record of everyone who has handled an exhibit from recovery to court, including the date, purpose, and condition of each transfer. For firearms...
- Biological Evidence Collection ProtocolsThe documented, unbroken record of everyone who collected, handled, transferred, examined, or stored an item of evidence from scene recovery to court presentat...
- Botanical Evidence Collection and PreservationThe documented sequence of possession, handling, and transfer of an exhibit from collection to court. Any unexplained gap undermines the admissibility and weig...
- The Branches of Forensic Science: A MapThe documented, unbroken sequence of possession and handling for a piece of evidence from collection through laboratory analysis to court. A requirement shared...
- CCTV and DVR Systems: Architecture and Evidence AcquisitionThe documented, unbroken record of who handled evidence, when, and for what purpose. Every transfer, examination, and storage event is logged so that any court...
- Chain of Custody: What Breaks It, and What Indian Courts Have SaidThe chronological documentation of who handled an item of evidence, when, where, and for what purpose, from collection to courtroom.
- Chain of Custody as a Legal ConstructThe documented record of every person who possessed, transferred, or handled a piece of evidence between collection and court presentation. Each link in the ch...
- Chain of Custody: What It Is and What Breaks ItThe continuous, documented record of who has had possession of an exhibit from the moment of collection to the moment of court presentation. Every transfer of...
- Chain of Custody for Clinical SpecimensThe documented, unbroken record of every person who has had possession of a piece of evidence and every transfer between persons or locations, from collection...
- Cyber Forensics vs Digital Forensics: Scope and BoundariesThe documented sequence of possession, handling, and analysis of evidence from collection to court. Required in both digital and cyber forensics. For network e...
- Cyber Investigation Reporting and Court PresentationThe chronological, documented record of who handled a piece of evidence, when, and what was done. For digital exhibits, hash verification at each transfer poin...
- Cyber Investigation Tools and Analytical WorkflowThe documented record of who handled a piece of evidence, when, and what was done with it at each stage, from collection through analysis to presentation in co...
- Digital Evidence in Financial CasesA documented record of every person who handled an exhibit from collection through court presentation, including acquisition dates, transfer events, and storag...
- Digital Evidence in Mobile and Network ContextsThe documented chronological record showing who had possession of an exhibit, when, and what was done with it. Every person who receives, handles, or transfers...
- Documentary Evidence and Chain of Custody in Fraud AuditsThe unbroken, documented record of who collected a piece of evidence, when, where, and how it was handled, stored, and transferred from collection through fina...
- Electronic Evidence and the Authentication CertificateThe documented record of who held or controlled a piece of evidence, when, and in what condition. For electronic evidence, this includes acquisition logs, hash...
- Electronic Evidence Statutes and Cyber OffencesA continuous, documented record of every person who handled an exhibit from seizure through court presentation. For digital exhibits this includes who seized t...
- Evidence Collection and Chain of CustodyThe documented, unbroken record of every person who collected, handled, transferred, or stored evidence from its collection through its presentation in court....
- Evidence Gathering Methods in Fraud ExaminationsThe documented record showing who collected an item of evidence, when, from where, and every subsequent transfer or storage event. It demonstrates that the evi...
- Evidence Preservation and DocumentationThe documented record of who has had possession of a piece of evidence, when, and for what purpose. In forensic engineering, chain of custody is less formalise...
- Evidence Preservation During ContainmentThe documented, unbroken record of every person who collected, received, transferred, examined, or stored a piece of evidence. Required for evidence to be admi...
- Forensic Archaeological Scene RecoveryThe documented record of every person who has handled an item of evidence from recovery to court presentation, with dates, times, and reasons for transfer. In...
- Forensic Biology Laboratory Organisation and AccreditationThe documented, unbroken record of every person who has handled a piece of evidence from the moment of collection to its presentation in court. A break in chai...
- Forensic Reporting and Expert Testimony in Mobile and Network CasesThe documented record of every person who handled a piece of evidence, when, and for what purpose, from seizure to court presentation. A gap in the chain of cu...
- Incident Reporting and DocumentationThe documented record showing who collected a piece of evidence, when, from what system, and every subsequent transfer or access. An unbroken chain of custody...
- Incident Response Goals and PrinciplesThe documented, unbroken record tracking who collected evidence, how it was stored and transferred, and who had access. Breaking chain of custody can render di...
- Intake, Scoping and Evidence PreservationThe continuous, documented record of who handled a piece of evidence, when, and what was done with it. A gap in chain-of-custody documentation allows a defence...
- Introduction to Crime Scenes: Types, Evaluation and ProcessingThe unbroken paper trail of who handled each piece of evidence, when, and for what purpose. Breaks here are what most defences attack.
- Lab Equipment and Chain of Custody for Fingerprint CaseworkThe continuous documented record of every individual who had physical possession of an exhibit, the conditions of transfer, and any examination or sampling act...
- Lab Equipment, Evidence Handling and Chain of CustodyThe documented, unbroken record of every person who handled an evidence exhibit from scene collection to court presentation, including the date, time, and cond...
- Lab Equipment, Evidence Handling and Chain of Custody in QDEThe continuous, documented record of who possessed a piece of evidence, at what time, under what conditions, and for what purpose, from the point of collection...
- Legal and Ethical Foundations of Cyber InvestigationsThe unbroken documented record of who had possession of a piece of evidence, what actions were taken, and when. For digital evidence, hash values computed at a...
- Legal and Jurisdictional Frameworks for Mobile and Network EvidenceThe documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes t...
- Legal Framework and Scene AuthorityThe continuous documented record of who had possession, control, or access to an exhibit from its recovery to its presentation in court. A gap in the chain can...
- Legal and Regulatory Framework for Forensic AuditsThe documented, unbroken sequence of possession, control, transfer, and analysis of evidence from the point of collection to its presentation in proceedings. A...
- Log Correlation and SIEM in Forensic InvestigationsThe documented record of who collected evidence, when, how it was stored, and who had access to it at each step. Maintaining chain of custody for SIEM exports...
- Mobile and Network Forensics: Scope and DisciplineThe documented record of every person who handled an exhibit and every action taken on it from seizure through analysis to court presentation. For digital evid...
- Narcotics Law and Forensic AnalysisThe unbroken, documented sequence of control over a physical exhibit from seizure through analysis and production in court. A gap in the chain creates a basis...
- Order of Testing and DNA PreservationThe documented, unbroken record of who collected, received, stored, transferred, and tested an exhibit at every point from the scene to the courtroom. Any gap...
- Packaging, Storage and the Cold Chain for Biological EvidenceThe documented record of every person who handled, examined, transferred, or stored an item of evidence from its collection to its presentation in court. For b...
- Physical Evidence: Nature, Types and ClassificationThe documented, unbroken sequence of possession and control from collection through analysis and presentation in court. A break in the chain can make otherwise...
- Physical Evidence: Nature, Types, Collection and Chain of CustodyThe continuous, documented record of every person who handled the exhibit from seizure to courtroom, with date, time, purpose and signature at each transfer.
- Post-Mortem Examination and Viscera Collection in PoisoningThe unbroken documentary trail of who held a sealed exhibit, when, and under what seal, from the moment of collection through analysis to its production in cou...
- Preservation, Labelling and Chain of CustodyThe documented, unbroken record of who collected, transferred, stored, and examined an exhibit from the moment of collection to its presentation in court. Any...
- Scope of Forensic Immunology: Specimens and ContextsThe documented, unbroken sequence of possession, transfer, and handling of a specimen from collection to court presentation. In forensic immunology, chain-of-c...
- The Scope of Biological Evidence in Forensic ScienceThe chronological documentation of who collected, handled, examined, and stored a piece of evidence from crime scene to court. Breaks in the chain of custody c...
- Search, Seizure and the Forensic ExhibitThe documented sequence of possession of an exhibit from seizure to court. Every person who handles the item must be recorded, along with the date, time, and c...
- Soil and Sediment as Trace EvidenceThe documented record of who collected a sample, when, where, how it was packaged, and every subsequent transfer of possession through to laboratory analysis a...
- Statutory Audit Versus Forensic Audit: Key DistinctionsThe documented record of who collected, handled, transferred, and had access to a piece of evidence from the point of collection to the point of presentation....
- Synthetic Media in Casework and Legal ProceedingsA documented, unbroken record of who has had possession of an exhibit, when, and in what condition, from collection through to court presentation. For digital...
- Text Messaging and Digital Language as EvidenceThe documented sequence of possession and handling of a piece of evidence from its collection through analysis to court presentation, establishing that it has...
- The Forensic Process: From Scene to CourtroomThe continuous, documented record of every individual who received, possessed, transferred, or handled a piece of evidence from collection at the scene to pres...
- The SAFE Kit: Components and Collection SequenceThe documented, unbroken sequence of possession of evidence from collection through laboratory analysis and into court. Any gap or undocumented transfer can ma...
- Types of Evidence: Oral, Documentary and RealThe documented sequence of possession, transfer, analysis, and storage of a physical exhibit from its discovery to its appearance in court. A gap in the chain...
- Volatile Data and the Order of VolatilityThe chronological record documenting who collected evidence, when, by what method, and how it was stored and transferred. RFC 3227 specifies the minimum chain-...
- What Is Cyber ForensicsThe documented record of everyone who handled a piece of evidence, from initial collection through analysis and court presentation. Any gap in the chain create...
- What Is Forensic Law and Why It MattersThe documented, unbroken record of who collected, handled, transferred, and analysed a piece of evidence from the moment of collection to the moment it is pres...
- Wildlife Crime and Biological EvidenceThe documented sequence of possession and handling of evidence from seizure through laboratory analysis to court presentation. Wildlife evidence chain of custo...
- Wildlife Crime Scene ManagementThe unbroken record of who held each exhibit, when, and under what conditions from collection to presentation in court. A gap in the chain can render evidence...