Chain of custody
= Chain of custody
In <digital forensics>, a \b[chain of custody] is the documented history of who possessed or handled an item of <digital evidence>, when transfers occurred and what actions were taken. It connects an analyzed item with its recorded collection and subsequent handling. The record concerns provenance and accountability, while <data integrity> concerns whether the relevant data changed.<Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others>[Section2.6 and section3.1.2, evidence handling and documentation; printedp.3-4]{ref}
For an original example, an evidence drive is recorded as collected by A at09:00, transferred to B at10:00 and delivered to C at12:00. If B's receipt and transfer record are missing, matching serial numbers at the endpoints do not explain what happened during the intervening interval. That is a gap in documentation, not by itself proof of alteration.
A <cryptographic hash function> supplies complementary evidence about a particular byte sequence. A matching digest can support continuity of the data under the hash function's security assumptions, but does not identify everyone who had access to it. A complete custody log likewise cannot establish the truth of every statement stored on a device.
A useful record therefore distinguishes the physical item, any acquired copies and the actions applied to each. Conclusions should state what that record supports; documentation alone does not determine every question about an incident.