What is chain of custody?

Chain of custody is the record that proves an item of evidence is what it claims to be and has remained in the same condition since it was collected. It applies to physical items such as documents, cheques and hard drives, and to digital data such as email exports, phone extractions and server logs. Each person who takes possession of the evidence becomes a link in the chain, and each link must be documented.

Why does chain of custody matter?

Evidence is only useful if its integrity can be shown. If a laptop passed through several hands without records, the opposing side can suggest that files were planted, deleted or modified in between. Chain of custody answers that challenge with a paper trail. It supports admissibility, but more often it affects the weight a court, tribunal or disciplinary panel gives to the evidence.

Digital evidence is particularly vulnerable. Simply switching on a device, opening a file or syncing a phone can change timestamps and metadata. That is why custody records for digital items are combined with hash values and forensic imaging, so analysis is done on a verified copy while the original is sealed.

How is chain of custody maintained?

A typical process for a seized device looks like this:

1. Seizure: photograph the device in place, note its state (on, off, locked), and record who is present.
2. Labelling and sealing: assign a unique evidence number and place the item in a tamper-evident bag with a recorded seal number.
3. Custody form: start a log recording the description, serial numbers, collector, date, time and location.
4. Acquisition: create a forensic image, record hash values of the source and the image, and note the tools and examiner.
5. Transfers: every hand-over is signed by both parties with date, time and purpose.
6. Secure storage: keep originals in a locked, access-controlled store with an access log.
7. Analysis and reporting: the examiner works on a verified copy and refers to evidence numbers and hash values in the report.

ISO/IEC 27037:2012 provides internationally recognised guidelines for identifying, collecting, acquiring and preserving digital evidence, and is often used as a benchmark for these steps.

What does Indian law say?

There is no single statutory definition of chain of custody, but several provisions make it important. Under the Bharatiya Sakshya Adhiniyam 2023, s. 57 Explanation 5 treats an electronic or digital record produced from proper custody as primary evidence unless it is disputed, so showing proper custody matters directly. Section 63 requires a certificate, signed by the person in charge of the device and an expert, recording hash values, whenever computer output is submitted; a reliable custody record makes that Section 63 certificate much easier to support.

For police investigations, the Bharatiya Nagarik Suraksha Sanhita 2023 requires searches and seizures, including the preparation of the seizure list, to be recorded by audio-video electronic means under s. 105, and for offences punishable with seven years or more, s. 176(3) provides for forensic experts to visit crime scenes and video-record evidence collection once States notify it. These requirements are part of the same goal: showing that evidence was handled properly from the start.

What breaks a chain of custody?

• Devices collected by line managers without any record.
• Unsealed evidence left in open offices.
• Missing signatures or times on transfer records.
• Copies made with ordinary tools and no hash verification.
• Several people examining the original instead of an image.
• Evidence couriered without tracking or tamper-evident packaging.

How is chain of custody different from related terms?

A hash value proves that data has not changed; chain of custody proves who had the evidence and when. A forensic image is the verified copy; chain of custody documents how that copy and the original were handled. All three work together, and together they underpin digital forensics work. Our article on preserving digital evidence in internal investigations explains how to set this up, and our digital forensics and eDiscovery service covers evidence collection with full custody documentation.