Documentary Evidence and Chain of Custody in Fraud Audits

Forensic auditors work with a broad range of documentary evidence, and each category presents a distinct set of authentication and preservation challenges. Understanding those challenges before collection begins is the difference between evidence that survives disclosure and evidence that gets excluded.

Third-party records are among the most reliable because they are obtained directly from sources independent of the suspect organisation. A bank statement obtained directly from the bank under a court order is far harder to challenge than a bank statement obtained from the suspect's own files. Where possible, the forensic auditor should seek to verify internally obtained records against an independent counterpart copy.

A chain-of-custody record must capture, for every piece of evidence: the unique identifier assigned to the item, the description of the item, the date and time it was collected, the location from which it was collected, the name and signature of the person who collected it, and the condition of the item at collection. Every subsequent transfer of the item from one custodian to another must be recorded with the same date, time, and dual signature. The record must be contemporaneous: entries written from memory after the fact are weaker than entries made at the moment of each action.

Physical evidence is typically sealed in a tamper-evident evidence bag immediately after collection. The bag is labelled with the case number, item number, description, date, time, and collector's initials. The bag is not opened except for examination, and each opening is recorded. Digital evidence items such as hard drives or USB devices are sealed in antistatic bags after forensic imaging is complete, with the hash value recorded on the bag and in the chain-of-custody form.

Storage conditions matter. Paper documents should be stored in a dry, climate-controlled environment. Electronic media should be stored away from magnets, heat, and humidity. Both categories should be stored in a secured, access-controlled location, with an access log recording every entry. Where evidence is voluminous, evidence management software can maintain the chain-of-custody record digitally, but the underlying discipline is the same: every touch is recorded.

The forensic imaging process for a hard drive or other digital medium follows a defined sequence. First, the device is connected to the forensic workstation through a write blocker. The write blocker intercepts any write commands sent by the operating system (Windows frequently issues write commands when a drive is mounted, even if the user takes no deliberate action) and prevents them from reaching the source device. Second, imaging software such as FTK Imager, EnCase, or open-source tools like dc3dd creates a sector-by-sector copy of the entire device, including deleted file areas and slack space. Third, the software computes a cryptographic hash of the source device before imaging and of the image after imaging. If the two hashes match, the copy is verified as identical to the source.

Hash algorithms commonly used in forensic work include MD5 (128-bit, faster but now considered cryptographically weak) and SHA-256 (256-bit, the current standard). In practice, many tools compute both and record both in the acquisition report. The hash value is recorded in the chain-of-custody form alongside the acquisition report, which documents the tool used, its version, the date and time of acquisition, the examiner's name, and the source device's identifying information (make, model, serial number).

Metadata is a critical component of ESI evidence and one that is frequently misunderstood or inadvertently destroyed. File system metadata includes creation timestamp, last-modified timestamp, last-accessed timestamp, and file size. Document metadata embedded in files such as Word documents or PDFs may include author name, revision history, and comments. Email metadata includes routing headers that show the path the message took through mail servers, which can confirm or refute a sender's claim that a message was not sent from their account. Forensic images preserve all of this; printouts or PDF exports of files do not.

Authentication standards share a common logic across jurisdictions but differ in their specifics. In each case the proponent of the evidence must satisfy the court that the document is what it purports to be, and the method of doing so depends on the type of document and the nature of any challenge.

India's Bharatiya Sakshya Adhiniyam 2023 is the current statute. Its predecessor, the Indian Evidence Act 1872, had a more limited and sometimes litigated certificate mechanism for electronic records (the old Section 65B). The 2023 Act updated the framework to better address cloud storage, encrypted communications, and forensic imaging. Practitioners working on Indian fraud matters should confirm which version of the statute applies based on the date the proceedings were initiated.

US FRE Rule 902(13) and (14), added in 2017, allow machine-generated records and electronic data to be self-authenticating if accompanied by a written certification from a qualified person. This significantly reduced the burden of authentication for common ESI categories such as server logs and network traffic records, which previously required testimony from a custodian of records in every case.

The Best Evidence Rule, as it is commonly called, requires the proponent of a document to produce the original when the content of the document is in dispute. The rationale is that copies are more susceptible to alteration than originals, and that if the original exists and can be produced, there is no reason to accept something less. In modern practice, the rule has been substantially qualified for electronic records.

Under FRE Rule 1001(e), an electronic original includes any printout or other output readable by sight that accurately reflects the electronic data. Under Rule 1003, a duplicate (defined as a counterpart produced by the same impression as the original, or by photography, or by mechanical or electronic re-recording) is admissible to the same extent as an original unless a genuine question is raised about the authenticity of the original or it would be unfair to admit the duplicate instead. A verified forensic image, with hash values matching the source, satisfies the definition of a duplicate and is generally admitted as the functional equivalent of the original device.

For paper documents, the forensic auditor's practice is to retain the original securely, use certified copies for working purposes, and produce the original for examination if challenged. Certified copies are produced by photographing or scanning the original in the presence of a witness, who signs a certification that the copy is a true and complete copy of the original. Where originals cannot be retained (for example, documents that belong to a third party who will not surrender them), the examiner photographs them on site, documents the circumstances, and notes that originals remain with the third party.

In practice, fraud investigations rarely involve a single, tidy set of records obtained from one location. Auditors commonly face mixed-media collections (paper and electronic records obtained simultaneously from the same location), records obtained in multiple tranches over weeks or months, records obtained from multiple jurisdictions under different legal authorities, and records that arrive in formats that must be converted for analysis without breaking the evidence chain.

Format conversion is a common challenge. An accounting database backup file must be restored into a forensic copy of the software to be readable. The restoration process must be documented to show that the content of the restored database matches the content of the original backup, typically by comparing record counts and hash values where the software permits. A similar issue arises when email archives in proprietary formats (such as Outlook PST files) are converted to standard formats (such as EML or MBOX) for ingestion into review platforms. The conversion process must be logged and the original proprietary archive preserved.

International evidence collection adds another layer of complexity. Evidence obtained in a foreign jurisdiction may need to be collected under that country's mutual legal assistance framework, or through letters rogatory, to be admissible in domestic proceedings. Evidence collected without compliance with the foreign jurisdiction's laws may be excluded in domestic courts, and the collection itself may expose the investigators to liability in the foreign jurisdiction. Forensic auditors engaged in cross-border investigations should confirm the applicable legal authority for collection in each jurisdiction before any evidence is touched.