01Purpose and scope
To be able to show, for any item at any time, an unbroken sequence of custodians and the condition of the item at each transfer, so that the item presented is demonstrably the item seized.
Applies to physical items, their forensic copies and derived data (images, extractions, exports). A digital copy has its own custody record anchored by its hash.
02Prerequisites
- Unique identifiers for items and for the matter.
- A form or system in which lines cannot be deleted, only added.
- Tamper-evident seals with unique numbers.
03Steps
Start at the point of seizure
The first line records the item identifier, description, where it was found, who collected it and when (UTC and local with zone).
RecordCustody line 1.
Record every transfer with both parties
Releasing custodian and receiving custodian each sign, with time, purpose (transport, storage, examination, return) and the seal number broken or applied.
RecordOne line per transfer.
Record condition at each transfer
Seal intact or broken, packaging, visible damage, power state for devices. A change in condition is noted, never corrected silently.
RecordCondition field on the line.
Log examination access
Each time an item leaves storage for examination and returns, two lines are added. The examination log (SOP-08) references the custody line.
RecordOut and in lines; storage log entries.
Anchor digital copies by hash
An image or extraction gets its own custody record: source item, tool, operator, time, file name, size and hash. Every later copy records the hash it was verified against.
RecordDigital custody record per copy.
Close the chain
Return to the submitter, transfer to another body, or documented disposal, each with a final signed line and the condition at release.
RecordClosing line.
04Records produced
- Chain-of-custody form per item, complete from seizure to release
- Digital custody records for images and extractions
- Seal log
05Pitfalls
- A gap of hours between two lines with no custodian named is a break in the chain that cannot be repaired afterwards.
- Correcting an entry by overwriting destroys the record; strike through, initial, date and re-enter.
- A working copy that is not hashed cannot be shown to be the same data as the verified image.
- Storing devices in an area without access logging makes every line between storage and examination unverifiable.