Glossary
Chain of Custody
The documented, unbroken record of who handled a piece of evidence, when, and why, ensuring its integrity and admissibility.
The chain of custody is the documented, unbroken trail that records everyone who has handled a piece of evidence, along with when, where, and why they did so. From the moment evidence is seized until it is presented in court, every transfer, access, and storage location must be logged.
This record matters because evidence is only useful if a court can trust that it was not altered, swapped, or contaminated. Any unexplained gap can render the evidence inadmissible. Integrity is reinforced technically through cryptographic hashing: an investigator computes a hash (such as SHA-256) of a disk image at acquisition and re-verifies it later, proving the data has not changed.
A solid chain of custody combines physical controls — sealed bags, secure storage, signatures — with these digital safeguards, so the evidence remains trustworthy and admissible throughout the investigation and any resulting proceedings.