What is chain of custody for digital evidenceA record of who handled a file, when, and why, from collection to court

What it means

NIST defines chain of custody as a process that tracks the movement of evidence through its collection, safeguarding and analysis lifecycle by documenting each person who handled it, the date and time it was collected or transferred, and the purpose of the transfer (NIST Glossary).

The US National Institute of Justice’s guide for law enforcement lists completing chain-of-custody documentation as part of case assessment, and suggests considering creating a known value for the subject evidence before acquiring it, such as a hash (NIJ, Forensic Examination of Digital Evidence, 2004). Hash fingerprints are explained in what is a file hash.

In US federal courts, evidence must be authenticated. Rule 901(b) gives examples that include testimony of a witness with knowledge and evidence describing a process or system and showing that it produces an accurate result. Rule 902(14) allows data copied from a device or file to be authenticated by a process of digital identification, shown by a certification of a qualified person, with notice to the other side (Rule 901, Rule 902). Rules differ by country, so check yours.