# What is a Chain of Custody?

> Chain of custody is the documented, auditable record of who collected, handled, transferred, stored, and analyzed evidence — proving it was not altered or substituted between collection and use.

- Canonical URL: https://yellowcube.eu/glossary/chain-of-custody/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Chain of custody applies to logs, disk images, memory captures, configuration snapshots, devices, and other material that may support an investigation, legal proceeding, insurance claim, or regulatory report. It records collection time and method, handler identities, storage locations, integrity values such as hashes, and every transfer or access.

### Key points

- **Integrity from the start:** Capture volatile data first, hash originals, work on verified copies, and log every action with time and actor.
- **Transfer records:** Record who handed material to whom, when, why, and under what authorization — including transfers to providers, counsel, or authorities.
- **Important limitation:** Documentation shows handling, not truth. A complete chain of custody cannot fix evidence that was incomplete, contaminated at collection, or interpreted incorrectly.

### Related terms

[Digital forensics and incident response (DFIR)](<https://yellowcube.eu/glossary/digital-forensics-and-incident-response/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>) · [Security telemetry](<https://yellowcube.eu/glossary/security-telemetry/>) · [Root cause analysis](<https://yellowcube.eu/glossary/root-cause-analysis/>)

### Sources

[NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response](https://csrc.nist.gov/pubs/sp/800/86/final) · [NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations](https://csrc.nist.gov/pubs/sp/800/61/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.