Chain of Custody Log
Definition
The continuous record documenting every person who accessed a digital exhibit, every transfer of possession, every examination action, and the hash values that verify data integrity at each stage. The log must be contemporaneous and signed.
- Applies to
- Digital exhibits
- Must record
- Access, transfer, examination actions, hash values
- Timing requirement
- Contemporaneous
- Authentication
- Signed at each entry
Common questions
Why must entries be contemporaneous rather than reconstructed later?+
A log written after the fact from memory is far more vulnerable to challenge on accuracy and is generally given less weight by courts than one made at the time each action occurred, since contemporaneous notes are harder to dispute or selectively recall.
What does re-checking hash values at each stage actually prove?+
It proves the underlying data has not changed since the previous logged step, so if a hash mismatch appears, investigators can pinpoint which handling stage introduced the alteration rather than only knowing the final state does not match the original.
Related terms
- ACPO Principles
- Four principles for digital evidence handling published by the UK's Association of Chief Police Officers (now maintained by the Forensic Science Regulator):...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Value (Digest)
- A fixed-length output produced by a cryptographic algorithm such as SHA-256 applied to a data set. Any change to the input data,...
- Working Copy
- A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...