Digital chain of custody: what it is and why it can make or break your evidence
The chain of custody is the record showing that evidence has not been altered from the moment it was obtained until it reaches the court. In the digital world, where a file can be changed without visible trace, it is especially important.
The role of hash functions
A hash function (for example SHA-256) produces a unique “fingerprint” of a file or disk. If a single bit changes, the fingerprint changes completely. Hashing at the time of acquisition and again later proves that the copy is identical to the original.
What must be documented
- Who obtained the evidence, when, where and with which tools.
- The hash of the original and of every working copy.
- Every transfer of the evidence between people or places.
- How it has been stored and protected.
Common mistakes
- Switching on and “browsing” a computer or phone before imaging it.
- Copying with non-forensic tools that change dates or metadata.
- Failing to record who has had access to the device.
Standards such as UNE 71506 (forensic analysis of electronic evidence) and ISO/IEC 27037 set out good practices that help defend the validity of the evidence.