What Is Chain of Custody? A Complete Guide

Chain of custody is the chronological, documented record of everyone who has handled an item of evidence from the moment it was collected until it is presented in court. A complete chain answers five questions for every step: who had the item, what they did with it, when they had it, where it was stored, and why it moved.

Courts care about chain of custody because it establishes two things at once: that the evidence offered at trial is the same item that was collected, and that it has not been altered, substituted, or contaminated along the way. Without that assurance, a judge may exclude the evidence or a jury may discount it.

Why an unbroken chain matters

Evidence is only persuasive if it is authentic. A "break" in the chain — an unexplained gap in time, a missing signature, an item that changed hands without a record — gives the opposing party an opening to argue that the evidence cannot be trusted. In practice, most challenges do not claim the evidence was actually tampered with; they simply point to the gap and let doubt do the work.

The remedy is boring but effective: document every transfer, every storage location, and every examination, contemporaneously and in a form that cannot be quietly edited later.

The core elements of a chain-of-custody record

A defensible record captures, at minimum:

• A unique identifier for the item and a description of what it is
• The date, time, and location of collection, and who collected it
• The condition of the item when collected
• Every subsequent transfer: who released it, who received it, when, and for what purpose
• Where the item was stored between transfers, and how access was controlled

Physical vs. digital evidence

For physical evidence — a weapon, a biological sample, a seized device — the chain is largely about custody and storage: sealed containers, evidence lockers, signatures on transfer.

For digital evidence — files, disk images, logs, mobile extractions — custody of the physical medium is not enough. Because digital data can be copied and modified without a trace, the record must also prove integrity: that the bytes examined are identical to the bytes collected. That is why forensic practice pairs the custody log with a cryptographic hash of the acquired data, so any later change is immediately detectable.

From paper forms to tamper-evident records

Traditional chain-of-custody forms are paper documents passed along with the evidence. They work, but they share a weakness: a paper log can be back-dated, rewritten, or lost, and nothing about the document itself proves it wasn't. Modern practice increasingly favors records that are tamper-evident by construction — where each entry is cryptographically linked to the last, so altering any earlier entry would be detectable.

That is the model CustodyTrack uses: every custody event is sealed into a hash chain, and anyone can verify the record's integrity without trusting the person who created it.

The bottom line

Chain of custody is not a formality — it is the foundation that makes evidence admissible and believable. Whether the item is a physical exhibit or a disk image, the goal is the same: a complete, contemporaneous, tamper-evident record that answers who, what, when, where, and why for every step of the item's life.