RDIV / ANSWER E-004 · EVIDENCE
What Is Digital Chain of Custody?
Digital chain of custody records how evidence is acquired, transferred, stored, accessed, transformed, and preserved over time.
Fix the object first.
A custody record normally identifies the evidence object, acquisition event, handlers or systems, storage locations, transfers, access, integrity checks, and any transformations. Hashes can help detect change but must themselves be preserved and contextualized.
The visible label is not the whole system.
Digital evidence can be perfectly copied and easily changed. A custody record makes later review possible by exposing who handled an object and whether the integrity controls remained intact.
Trace the burden.
- NIST SP 800-86 defines digital forensics around identification, collection, examination, and analysis while preserving information integrity and maintaining chain of custody.
- NIST IR 8387 recommends documenting original source and using approved hashes/digital signatures as part of evidence preservation.
- Legal admissibility standards vary by jurisdiction and proceeding.
- A valid custody chain cannot prove that the original source was truthful.
Where the work adds something.
R/IV borrows the discipline, not the legal label: every admitted source object should have an acquisition history sufficient to distinguish the preserved record from later transformations and model outputs.