Chain of Custody: What It Is and What Breaks It

The chain of custody rests on a simple premise: if you cannot prove who had an exhibit at every point in time, you cannot prove the exhibit was not altered during an unaccounted interval. A DNA profile matched to a suspect means nothing if the defence can show the DNA sample sat in an unlocked room for three days with access by unknown persons. The match may be real and the science sound, but the court has no reliable basis to act on it.

This is not a technicality invented by lawyers to frustrate investigators. It is a logical requirement of evidence integrity. Physical evidence is unique in that it cannot be regenerated: if the sample is compromised, the only recourse is to explain convincingly how that could not have affected the result. That explanation is easier to make if the chain is intact and harder if it has gaps.

The chain is not just paper. It is the combination of documentation and physical security. The transfer log names the people. The tamper-evident packaging shows whether the item was opened. The evidence storage facility's access log shows who entered the room. These three layers together make it very difficult to challenge a well-maintained chain and very easy to challenge a poorly maintained one.

The documentation trail begins at the moment of collection and follows the exhibit through every subsequent movement. In a typical case, an exhibit travels through several distinct custody points, each of which must be logged.

1. Collection at scene
   The collecting officer seals and labels the exhibit with their name, badge number, exhibit reference, date, and time. This initial entry is the first link in the chain. Any witness present at collection is also noted.
2. Transfer to exhibits officer
   The collecting officer delivers the exhibit personally (or via a named transport officer) and signs it over on the exhibit register. The exhibits officer inspects the seal (confirming it is intact), signs for receipt, and assigns a storage location. Both parties sign; one receipt cannot substitute for the other.
3. Transfer to laboratory
   A request form documents what analysis is needed, which exhibits are being sent, the seal condition at dispatch, and who is carrying them. The laboratory receipt officer signs for the sealed packages on arrival, recording the condition of each seal. This receipt becomes part of both the case file and the laboratory's records.
4. Within-laboratory transfers
   Every internal move between departments, storage areas, and analysts generates an internal transfer record. A laboratory that loses track of an exhibit between intake and reporting has broken the chain within its own four walls, a break that defence counsel will examine in detail.
5. Return and court presentation
   After analysis, the exhibit is returned to the exhibits officer. At trial, the officer who collected the item, the exhibits officer, the analyst, and any couriers must all be able to verify their signatures on the chain and confirm the exhibit's condition at each point.

Chain-of-custody failures fall into four main categories. Understanding each one helps practitioners recognise and prevent them before they reach court.

• Gaps in the log. An exhibit signed out of the evidence room with no corresponding return entry. An analyst who received the exhibit but did not sign the transfer form until three days later. A handover from one officer to another witnessed by nobody and unrecorded. Each gap is an interval during which the exhibit was outside documented control.
• Broken or absent seals. A package that arrives at the laboratory with its tamper-evident seal already broken has an unanswerable question: when was it opened, and by whom? Even if the contents are intact, a court cannot confirm this from the packaging alone.
• Mislabelling. Two similar exhibits given the same reference number. An item that is described on its label differently from how it is described in the exhibit register. A label applied to the wrong package. Mislabelling creates doubt about identity: is this the item that was collected, or a different one?
• Unsecured storage. Evidence left in an unlocked vehicle overnight. A shared evidence room without an access log. A package stored in an unlocked desk drawer. Even if nothing was touched, the absence of documented security means a court cannot rule out that it was.
• Evidence tampering. Deliberate alteration, addition, removal, or substitution of evidence. Tampering is a criminal offence in every jurisdiction. It is also relatively rare compared to the other failures on this list. Most chain-of-custody breaks are administrative failures, not deliberate misconduct.

The primary legal consequence of a broken chain of custody is the exclusion of the affected exhibit. A judge who is not satisfied that an item is the same one collected, or that it remained unaltered, has a duty to exclude it from the proceedings. The jury never sees it, never hears the forensic results from it, and cannot use it in their deliberations.

The secondary consequence is what happens to the rest of the prosecution's case. If the excluded exhibit was central, its removal can make the remaining evidence insufficient for a conviction. In serious cases, the prosecution may offer no evidence and the defendant is acquitted. This happens not because they were found innocent but because the evidence against them was no longer admissible.

In civil law countries (France, Germany, Japan, Brazil), the court typically exercises more inquisitorial control over evidence and may rely on its own investigators. Even there, the integrity of the physical record matters: a court-appointed expert who cannot account for how a sample was stored between collection and analysis will have their conclusions questioned or set aside.

Physical exhibits can be inspected visually for signs of tampering. A re-sealed bag, a broken label, a container with adhesive residue: these are visible. Digital evidence carries no such physical indicators. A file copied from a hard drive is bit-for-bit identical to the original, but the copy date in the file metadata will be different. A file whose content was altered will look identical unless a hash value was recorded at acquisition.

Hash verification is the digital chain of custody. When a hard drive is imaged, a cryptographic hash (typically SHA-256) of the full image is calculated and recorded. At every subsequent point where the image might have been modified, the hash is recalculated. If the values match, the image is confirmed unaltered. If they differ, something changed and the chain is broken for that item. Courts in the US, UK, India, and Australia have accepted hash verification as a sufficient authentication method for digital exhibits.

The chain of custody is not maintained by policy documents; it is maintained by individual actions repeated correctly thousands of times. The practical habits that prevent breaks are not complicated, but they require discipline in conditions (high workload, urgent timelines, fatigue) that are precisely where shortcuts are most tempting.

• Never accept an exhibit without checking the seal and completing the transfer log before releasing it from your possession. Not later, not after the shift ends.
• Never leave an exhibit unsecured, even briefly. If you must put it down before the transfer is complete, that is a storage decision requiring a secure location and an entry in the log.
• Label at the scene, not at the station. Memory is unreliable; a description written twenty minutes after the fact is worse evidence than one written at the moment of collection.
• Minimise the number of people who handle any single exhibit. Every additional handover is an additional link in the chain that must be documented and that can be challenged.
• Report breaks immediately when they occur. An undisclosed gap found by the defence in court is far more damaging than a disclosed gap reported and explained at the time. Procedural honesty about failures is the only way to manage them.