Chain of Custody Log
Definition
The continuous record documenting every person who accessed a digital exhibit, every transfer of possession, every examination action, and the hash values that verify data integrity at each stage. The log must be contemporaneous and signed.
- Applies to
- Digital exhibits
- Must record
- Access, transfer, examination actions, hash values
- Timing requirement
- Contemporaneous
- Authentication
- Signed at each entry
Common questions
Why must entries be contemporaneous rather than reconstructed later?+
A log written after the fact from memory is far more vulnerable to challenge on accuracy and is generally given less weight by courts than one made at the time each action occurred, since contemporaneous notes are harder to dispute or selectively recall.
What does re-checking hash values at each stage actually prove?+
It proves the underlying data has not changed since the previous logged step, so if a hash mismatch appears, investigators can pinpoint which handling stage introduced the alteration rather than only knowing the final state does not match the original.
Related terms
- ACPO Principles
- Four principles for digital evidence handling published by the UK's Association of Chief Police Officers (now maintained by the Forensic Science Regulator):...
- Forensic Image
- A forensic image is a documented representation of acquired storage data, commonly a physical bitstream image or a defined logical acquisition. Its...
- Hash Value (Digest)
- A fixed-length output produced by a cryptographic algorithm such as SHA-256 applied to a data set. Any change to the input data,...
- Working Copy
- A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy...
- Write Blocker
- A write blocker prevents supported write commands from reaching specified source media during acquisition. Its effectiveness depends on the interface, configuration and...