Chain of custody predates digital evidence by a long way, and the underlying question is unchanged: can you show this is the same thing you collected, unaltered?
What the record establishes
Two claims, both of which can be contested:
- Authenticity. The data is what it is said to be, from the account and system claimed.
- Integrity. It has not changed since collection.
Neither is self-evident from the data itself. A file proves nothing about its own provenance. The record is what makes the claims testable.
What a defensible chain contains
For every step from collection to delivery:
- Who performed the action, identified specifically
- When, to a meaningful precision, with timezone
- What system the data came from
- What was done: collected, converted, redacted, transferred
- Where it went next, and how it was protected in transit and at rest
Cryptographic hashing is the part that does the heavy lifting for digital evidence. A hash computed at collection and re-verified at any later point demonstrates the content did not change in between, which no amount of narrative documentation can establish as convincingly.
Where digital evidence differs
| Physical evidence | Digital evidence | |
|---|---|---|
| Alteration | Usually leaves visible traces | Can be undetectable without hashing |
| Copying | Produces a distinguishable copy | Produces an identical copy |
| Custody | One holder at a time | Can exist in many places at once |
| Integrity proof | Seals, signatures, storage records | Cryptographic hashes |
The row that matters most is the last. Because a digital copy is indistinguishable from its source, the procedural controls that work for physical evidence do not transfer, and hashing is what replaces them.
What it means for a company producing data
- Timestamp and attribute every step, including automated ones.
- Hash at collection, and record the hash where it can be produced later.
- Log the export, including which query or scope produced the set.
- Track redaction as a step in the chain, not outside it. A redacted production is a derived artefact and the derivation should be recorded.
- Keep the record as long as the matter could live. Prosecutions and appeals run for years, and the person asked to attest to a collection may not be the person who performed it.
That last point is the practical argument for making this systemic rather than procedural. A chain of custody that depends on one engineer remembering what they did in a particular week is not a chain of custody.