What it means
Chain of custody records who collected, transferred, stored, accessed, and returned or disposed of an item. Digital evidence also requires hashes, timestamps, source details, tool information, and preservation of originals.
Why it matters
Good handling allows others to understand where evidence came from and whether it remained trustworthy.
Practical focus
- Assign unique evidence identifiers
- Record every transfer and access
- Hash and protect digital copies
- Store originals securely and analyze working copies
Common mistakes
- Collecting evidence without authority
- Failing to document time and source
- Allowing evidence to be edited during analysis
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: