In digital forensics, a chain of custody is the documented history of who possessed or handled an item of digital evidence, when transfers occurred and what actions were taken. It connects an analyzed item with its recorded collection and subsequent handling. The record concerns provenance and accountability, while data integrity concerns whether the relevant data changed.[ref]
For an original example, an evidence drive is recorded as collected by A at09:00, transferred to B at10:00 and delivered to C at12:00. If B's receipt and transfer record are missing, matching serial numbers at the endpoints do not explain what happened during the intervening interval. That is a gap in documentation, not by itself proof of alteration.
A cryptographic hash function supplies complementary evidence about a particular byte sequence. A matching digest can support continuity of the data under the hash function's security assumptions, but does not identify everyone who had access to it. A complete custody log likewise cannot establish the truth of every statement stored on a device.
A useful record therefore distinguishes the physical item, any acquired copies and the actions applied to each. Conclusions should state what that record supports; documentation alone does not determine every question about an incident.
New to topics? Read the docs here!