Chain of custody

What it is for

To answer one question convincingly: is what you produced the same as what was collected? A chain of custody record is how that question gets answered with documentation rather than with someone’s recollection two years later.

For digital evidence the question is sharper than it sounds, because files change silently. Opening a document can update its access time. Copying with the wrong tool can drop metadata. Converting a format can re-encode content.

What a record contains

Nothing exotic. For each step:

• What was handled, identified specifically enough to be unambiguous.
• Who handled it, by name.
• When, with a date and ideally a time.
• What was done — collected, copied, converted, imaged, produced.
• Where it went, and where the original is now.

Hash values are what make it verifiable. A hash recorded at collection and re-computed later demonstrates that the bytes have not changed. This is why tools that preserve attachments byte-for-byte matter: an attachment that has been re-encoded cannot be checked this way, because its hash has changed for a benign reason that is indistinguishable from a suspicious one.

Where small firms tend to break it

Not through anything dramatic. The common failures are mundane:

• Collecting by forwarding messages, which creates new messages with new headers rather than copies of the originals.
• Letting the client decide what to collect, and not recording that this is what happened.
• Converting formats without noting that a conversion occurred.
• Keeping only the produced PDFs and discarding the natives, which leaves nothing to verify against.

None of these are usually fatal. All of them are easier to have avoided than to explain.

Proportionality

A two-party contract dispute over a dozen emails does not need a forensic imaging protocol. It needs someone to write down where the messages came from, who pulled them, when, and what was done to them — which is perhaps ten minutes of work at the time and unreconstructable afterwards. The formality scales with what is at stake and with how likely anyone is to contest it.