Chain of custody

Chain of custody is the chronological documentation that records the sequence of custody, control, transfer, and analysis of physical or electronic evidence. It provides a verifiable trail showing who handled an item, when they had it, and why it was accessed. This process ensures the integrity of the evidence by proving it has not been tampered with or altered.

In practice

During a forensic audit, a practitioner reviews custody logs to verify that a seized hard drive was stored in a secure locker and only accessed by authorized personnel throughout the investigation.