Chain of Custody

Every handover is written down: what the item is, when and where it was taken, who had it, where it was stored and why it changed hands. Physical items go into sealed, labelled bags or containers. Digital evidence is copied by a method that proves the copy matches the original, usually through a hash value, which is a fingerprint that changes if a single bit changes. A gap in the log, an unexplained delay or an item left in an open desk gives the other side room to argue that it was tampered with, which can lead a court or tribunal to reduce its weight or exclude it. The same discipline applies in internal investigations, regulatory inquiries and disputes, not only in police work. Anyone who later relies on the evidence, from an investigator to a judge, depends on the record being complete.

During an internal fraud inquiry, an investigator takes a finance manager's laptop. She logs the time, photographs the seals, records the serial number and hands it to a forensic lab, which signs for it. Each later access to the forensic image is logged, so the company can show nothing changed.