Chain of custody applies to logs, disk images, memory captures, configuration snapshots, devices, and other material that may support an investigation, legal proceeding, insurance claim, or regulatory report. It records collection time and method, handler identities, storage locations, integrity values such as hashes, and every transfer or access.
Key points
Integrity from the startCapture volatile data first, hash originals, work on verified copies, and log every action with time and actor.
Transfer recordsRecord who handed material to whom, when, why, and under what authorization — including transfers to providers, counsel, or authorities.
Important limitationDocumentation shows handling, not truth. A complete chain of custody cannot fix evidence that was incomplete, contaminated at collection, or interpreted incorrectly.