Chain of custody
Chain of custody is the documented history of who collected, held, transferred, or handled evidence, when they did so, and why.
Know which evidence changed hands
A log archive passed between teams needs more than a filename. Identify the evidence, its collector, the collection time, and each subsequent transfer or handling step required by the investigation’s procedures. NIST’s definition explicitly includes the people involved, timing, and purpose of transfers.
For digital material, distinguish the acquired evidence from copies made for analysis. Document where each is held and how it relates to the original. Reconstructing a recovery incident explains how those records support a defensible timeline.
A hash is useful, but it is not the whole history
An integrity hash helps compare a file with an earlier recorded version. It does not say who possessed the file between checks, why it moved, or whether the original export was complete. The handling record answers a different question from the integrity check.
Evidence preservation is the broader work of keeping material available and intact. Chain of custody documents its handling. Follow the organization’s applicable evidence procedures; a generic template does not establish that every investigation requirement has been met.
Record transfers through the investigation’s approved channels. The custody record documents what happened; it does not grant permission to release the material. The eDiscovery export article covers that approval decision.