# What Is Chain of Custody for Digital Evidence? | Kodex Source: https://www.kodexglobal.com/glossary/chain-of-custody > Chain of custody documents every handoff of evidence from collection to court. Learn what a defensible record contains and why gaps matter. Request Operations ## Chain of Custody Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility. Chain of custody predates digital evidence by a long way, and the underlying question is unchanged: can you show this is the same thing you collected, unaltered? ### What the record establishes Two claims, both of which can be contested: - Authenticity. The data is what it is said to be, from the account and system claimed. - Integrity. It has not changed since collection. Neither is self-evident from the data itself. A file proves nothing about its own provenance. The record is what makes the claims testable. ### What a defensible chain contains For every step from collection to delivery: - Who performed the action, identified specifically - When, to a meaningful precision, with timezone - What system the data came from - What was done: collected, converted, redacted, transferred - Where it went next, and how it was protected in transit and at rest Cryptographic hashing is the part that does the heavy lifting for digital evidence. A hash computed at collection and re-verified at any later point demonstrates the content did not change in between, which no amount of narrative documentation can establish as convincingly. ### Where digital evidence differs Physical evidenceDigital evidence Alteration Usually leaves visible traces Can be undetectable without hashing Copying Produces a distinguishable copy Produces an identical copy Custody One holder at a time Can exist in many places at once Integrity proof Seals, signatures, storage records Cryptographic hashes The row that matters most is the last. Because a digital copy is indistinguishable from its source, the procedural controls that work for physical evidence do not transfer, and hashing is what replaces them. ### What it means for a company producing data - Timestamp and attribute every step, including automated ones. - Hash at collection, and record the hash where it can be produced later. - Log the export, including which query or scope produced the set. - Track redaction as a step in the chain, not outside it. A redacted production is a derived artefact and the derivation should be recorded. - Keep the record as long as the matter could live. Prosecutions and appeals run for years, and the person asked to attest to a collection may not be the person who performed it. That last point is the practical argument for making this systemic rather than procedural. A chain of custody that depends on one engineer remembering what they did in a particular week is not a chain of custody. FAQ ### Frequently asked questions Does chain of custody apply to data a company produces in response to a request? Yes. Data produced to law enforcement may end up as evidence in a prosecution, and the defence may test how it was collected, whether it could have been altered, and whether the producing company can attest to its integrity. A production with no supporting record is harder to authenticate. What does a defensible record actually contain? For each step: who performed it, when, what system the data came from, what was done, and where the data went next. Cryptographic hashes taken at collection and verified later are the strongest evidence that content did not change in between. What happens if the chain is broken? Evidence is not automatically excluded, but the gap becomes an argument. Opposing counsel can contend the data may have been altered or misattributed, and courts weigh the significance of the break. The practical cost lands on whoever has to testify about what happened during the gap. Glossary ### Related terms #### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. #### Redaction Redaction is the permanent removal of information from records before they are produced, typically to withhold data about third parties or material outside a request’s scope. Effective redaction removes the underlying data rather than obscuring it visually, and failures here are usually technical rather than editorial. #### Legal Hold A legal hold is an internal instruction suspending the routine deletion of records that may be relevant to anticipated or pending litigation or investigation. Unlike a preservation request, it is imposed by an organisation on itself, and the duty to issue one arises as soon as litigation is reasonably foreseeable. See how Kodex maintains auditable records of every request and production. Learn more