Custodian
Definition
In e-discovery, a person who possesses, controls, or has responsibility for documents or electronic records relevant to an investigation. Identifying custodians is the first step in scoping a document collection.
- Field
- E-discovery / digital forensics
- Role
- Possesses or controls relevant records
- First step
- Custodian identification scopes the collection
- Typically includes
- Employees, IT admins, department heads
Common questions
Is a custodian always the person who created the document?+
No. A custodian is anyone with possession, control, or responsibility for a record, so an IT administrator holding backup tapes or a manager whose shared drive contains a colleague's file both qualify even if they never authored it.
Why does misidentifying a custodian create legal risk?+
Missing a relevant custodian at the scoping stage can mean responsive documents are never collected, which can later be characterized as spoliation or an incomplete production even without any intent to withhold evidence.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- ERP System
- Enterprise Resource Planning software (SAP, Oracle, Microsoft Dynamics, and similar platforms) that manages financial and operational records. ERP databases are often the...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...