TimeBinder adds a layer of protection against AI and human fraud and disputes. For a digital exhibit, the plainest protection is a log kept at the time: who had the file, when, and what its fingerprint was.
When someone later says an exhibit was altered, the first thing a lawyer needs is a record of what happened to the file between its source and the hearing. That record is a chain-of-custody log. Forensic examiners keep very detailed ones. A law firm handling a client’s screenshots, recordings and PDFs needs a lighter version, but the same logic applies.
This guide sets out what the practitioner guidance says, the fields we suggest a firm records, and a fictional worked example. It is general information for lawyers in the US, UK and Europe first, not legal advice. It is not a substitute for a forensic examination, which is a separate job.
Table of Contents
Why a custody log matters
Authenticating a file comes down to showing it is what you say it is. In US federal practice, Rule 901(a) asks for evidence sufficient to support that finding, and Rule 902(14) allows data copied from a device or file to be authenticated by a “process of digital identification” certified by a qualified person. The 2017 Committee Note explains that this is ordinarily done by hash value. A certification can only be as good as the facts behind it, and a custody log is where those facts are written down while they are fresh. We cover the rules in deepfake evidence and the rules.
In England and Wales, a party who doubts a disclosed document can serve a notice to prove it under CPR 32.19. The side relying on the document is then better placed if it can say where the file came from, who handled it and that it has not changed.
What the practitioner guidance says
Two sources are widely used. Both are written for forensic and law-enforcement practitioners, so treat them as a standard to borrow from, not a checklist a firm must complete.
- ACPO Good Practice Guide for Digital Evidence (version 5, October 2011). It sets four principles. No action should change data that may later be relied on in court. A person who must access original data must be competent and able to explain what they did. An audit trail or other record of all processes applied to digital evidence “should be created and preserved,” so that an independent third party can examine the processes and reach the same result. And the person in charge is responsible for compliance. The guide is primarily written for UK law enforcement personnel.
- SWGDE Best Practices for Computer Forensic Acquisition (17-F-002-2.1, version 2.1, 5 August 2025). It says examiners should compute cryptographic hash values over acquired data and document the acquisition. The suggested record includes a unique identifier, the source, the case number, the hash values, who acquired it and the date and time including the time zone. For transfers, the chain of custody should note at a minimum the unique identification of the item, who transferred it, who received it, the date and time of receipt and transfer, and the purpose of transfer. After acquisition and verification, a working copy should be used for examination. The intended audience is personnel qualified to acquire digital evidence.
The fields we suggest a firm records
| Field | What to record | Why |
|---|---|---|
| Exhibit ID | A unique reference, such as the matter number plus a running number | Identifies the item “to the exclusion of all others” (SWGDE) |
| Description | Exact file name, type and size, and what it purports to be | Lets anyone find the same file later |
| Source | Who supplied it, from which account or device, and how it was sent | Provenance is the first question asked |
| Received by and when | Name, date, time and time zone | Time zone avoids arguments later |
| Fingerprint | The SHA-256 hash value, and the tool used to compute it | The baseline for every later comparison |
| Storage | Where the original is kept and who can write to it | Shows the original was left alone |
| Transfers | From whom, to whom, date and time, purpose | The SWGDE minimum for each transfer |
| Working copies | Where each is, and the hash after copying | Work happens on copies, never the original |
| Notes | Anything unusual, such as errors or a file that would not open | Gaps explained at the time are easier to defend |
Compute the fingerprint when the file arrives, before anyone opens it. Our guides on checking whether a file has changed and checking a SHA-256 checksum show how.
A fictional worked example
Illustrative only: the people, firm and addresses are invented. A client, Sam Rivera, forwards a screen recording of a voice message to a firm. The paralegal opens a log line the same day.
| Field | Entry |
|---|---|
| Exhibit ID | M-2026-0417-03 |
| Description | rivera-voicemail-recording.mp4, MP4, 18.4 MB, purports to show a voicemail received on the client’s phone |
| Source | Sam Rivera, from sam@client.example, by secure file link, original screen recording |
| Received | 11 November 2026, 09:42 (Brisbane, UTC+10), by the paralegal |
| Fingerprint | SHA-256 recorded at receipt (64 characters, pasted into the log) |
| Storage | Matter folder, read-only; original not opened |
| Transfer 1 | Paralegal to supervising solicitor, 11 November 2026, 11:05, for review; copy made and hash re-checked |
| Notes | Client says the original voicemail is still on the phone; request made to keep the phone unchanged |
Note the last line. If the audio matters to the case, the phone is the better source than a screen recording, and a forensic examiner may be needed to collect from it.
Rules of handling that keep the log honest
- Fingerprint first, open second. Opening and re-saving a file can change it.
- Never work on the original. Make a copy, check its hash matches, and work on the copy.
- Log at the time. Write each entry when it happens, not at the end of the matter.
- Record time zones. A date alone is not enough across offices and countries.
- Log every transfer. Including email forwards and shared links, with the purpose.
- Re-check the hash when a file moves. A mismatch should be noted and explained, not ignored.
- Keep the original source if you can. A phone, a camera card or a mailbox may hold more than a forwarded copy.
When to bring in a forensic examiner
A custody log shows what happened to a file once your firm had it. It does not show what happened before. If the file may have been generated or altered, or if the original device holds data you need, an examiner can collect and analyse it, and can give evidence on method and limits. See forensic examination vs an independent timestamp for what each can and cannot show.
How a TimeBind fits, and what it does not show
A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches its fingerprint. Creating one when the file arrives gives your log a time recorded outside the firm, which sits alongside the “Received by and when” and “Fingerprint” entries. Your browser makes the fingerprint and the file stays on your device.
A TimeBind shows that this exact file existed no later than the recorded time and still matches its fingerprint. TimeBinder makes the fingerprint in your browser and the file stays on your device. It does not show who made the file, who owns it, or that anyone agreed to it. It does not replace the log itself, and it does not show where the file came from before it reached you. It complements your engagement terms, your professional rules and legal advice; it does not replace them. This is general information, not legal advice.
Frequently asked questions
Is a chain-of-custody log required for every digital file?
No. Law-firm handling is not the same as forensic acquisition. Keep a log for files that may be disputed or relied on as exhibits, and keep it proportionate. Check the rules and any directions in your own court.
Which hash algorithm should we use?
SWGDE says to use a NIST-approved hash algorithm. SHA-256 is widely used and is what TimeBinder uses for its fingerprints.
Can a screenshot or screen recording be the exhibit?
It can be what you hold, but it is a copy of something else. Ask for the original, and keep the source device unchanged if the content matters. See our guide on screenshots as evidence.
Does a TimeBind replace a custody log?
No. A TimeBind adds a dated record that the exact file existed no later than a recorded time and still matches. The log records who handled the file and what was done.
What does it cost to date an exhibit?
Your first Pooled TimeBind is free, with no credit card required. After that, Pooled TimeBinds start from US$5, and an ASAP TimeBind is US$15.
Sources checked
Checked on 11 November 2026. We quote only what these documents say and mark where a point depends on your own rules or local law. Anything we could not verify from a primary source is left out.
- ACPO Good Practice Guide for Digital Evidence, version 5, October 2011: the four principles and the application section (copy hosted by a third party)
- SWGDE Best Practices for Computer Forensic Acquisition, 17-F-002-2.1: version 2.1, 5 August 2025: documentation fields, chain-of-custody minimum, hashing and working copies
- Federal Rule of Evidence 902: 902(14) and the 2017 Committee Note on hash value
- Civil Procedure Rules, Part 32: rule 32.19
- TimeBinder pricing: Pooled and ASAP prices
Start the log with the next exhibit
Fingerprint the file when it arrives, log the entry, and date it so the record exists before any dispute. Your first Pooled TimeBind is free, with no credit card required. After that, Pooled TimeBinds start from US$5, and an ASAP TimeBind is US$15. Prices checked 11 November 2026. See plans and pricing. Open TimeBinder
