What Is Chain of Custody?

Chain of custody is the documented record of who handled evidence, when, and what they did with it. It exists so that findings can withstand the question that follows any serious investigation: how do we know this evidence is what you say it is?

Without it, technically sound analysis can be dismissed on procedural grounds, which is a poor way to lose an argument.

What the record has to show

Who acquired the evidence, from where, when, and using what method. Every transfer between people or systems, with dates, times and both parties identified. Where it was stored and who could reach it.

And a cryptographic hash taken at acquisition, recomputed at each handover. A matching hash demonstrates the data has not changed; that single mechanism carries most of the integrity argument.

Why it matters outside a courtroom

Most incidents never reach litigation, and the record still earns its cost. Regulators ask how conclusions were reached. Insurers assess claims against the evidence. Affected customers and partners may contest what they were told.

Internally, it protects the investigators. An intrusion involving systems administered by the people investigating it creates an obvious question, and documented handling is the answer to it.

Working on copies

Analysis is performed on verified copies, never on originals. The original is acquired, hashed, stored and left alone; working copies are made from it and verified against the same hash.

This is partly integrity and partly practicality — analysis is iterative and destructive of state, and being able to return to a known-good copy is what makes it repeatable.

Where it commonly breaks

The first hour. Somebody copies a suspicious file to a shared drive, forwards an email, or logs into the affected machine to have a look — all reasonable instincts, all of which alter state and leave no record of who did what.

Also common: gaps in the record while evidence sat somewhere unlogged, and copies proliferating to personal machines and mailboxes during the urgency of response.

Cloud and virtual evidence

The same principles apply and the mechanics differ. Snapshots and exported logs should be hashed at export, and the export itself documented: who requested it, from which account, over what period, using what interface.

Provider-side audit records showing the export are useful corroboration and are worth capturing at the same time.

Who should hold it

Custody is stronger when the person documenting and storing evidence is not the person who administers the systems under investigation. That separation answers the conflict-of-interest question before anyone raises it.

In small organisations that separation is not always possible, and the workable substitute is thorough documentation plus early involvement of an external party for anything that may be contested. Naming in advance who acts as custodian removes one decision from the first hour.

Where to start

Add an evidence log template to your response plan and name who maintains it. It is one page, it costs nothing, and it is not something that can be produced after the fact.

See evidence preservation. GuardsArm delivers incident response.