Demonstrating that evidence is what you say.
WHAT CHAIN OF CUSTODY IS
A record of who held evidence, when, and what they did with it.
WHY IT MATTERS
Evidence whose handling cannot be accounted for is challenged successfully.
WHAT TO RECORD FOR EVERY ITEM
What it is, identified specifically Where it came from Who collected it, and when Who has held it since What was done to it Where it is now
WHY SPECIFIC IDENTIFICATION
Serial numbers and identifiers distinguish one device from another.
WHAT TO RECORD FOR DIGITAL COPIES
How the copy was made What tool was used A verification value proving the copy matches the original
WHY A VERIFICATION VALUE
It demonstrates the copy has not changed since it was taken.
WHAT TO ESTABLISH
That the value is recorded at the time of copying.
WHAT TO DO WITH ORIGINALS
Secure them, and work only on copies.
WHERE TO KEEP THEM
Somewhere access-controlled, with access recorded.
WHAT TO AVOID
Passing devices between people without recording it Storing evidence where others can reach it Examining originals
WHY
Each defeats the ability to rely on what was found.
WHAT TO ESTABLISH
A single person responsible for evidence handling.
WHAT TO RECORD ABOUT EXAMINATION
Who examined what, when, using what, and what was found.
WHY
It allows the work to be repeated and verified.
WHAT TO KEEP
The record, with the evidence, for as long as the matter may continue.
WHY LONG
Proceedings arise long afterwards.
