Chain of custody is the documented chronological record of who handled a piece of evidence, when, where, and what was done with it. Standard practice in criminal forensics, civil-litigation discovery, and corporate-investigation work product. The break in chain of custody is the standard defense-side challenge that excludes evidence from courtroom use. Applies equally to physical evidence (seized devices, paper documents) and digital evidence (forensic images, logs, screenshots).
What it means in practice
The chain-of-custody discipline matters because evidence that was handled improperly may be inadmissible. The minimum documentation: who took possession (named individual, role, agency), when (timestamp), from whom (the prior custodian), where (location), what was the condition (intact, sealed, hashed if digital), and what was done with it (stored in evidence locker, transferred to lab, analyzed, copied for production). Each handoff is logged. For digital evidence, the cryptographic hash of the forensic image at acquisition becomes the integrity check; subsequent analyses must work from copies and verify that the source hash matches the acquisition hash. The operational reality: chain-of-custody documentation is boring, time-consuming, and structurally essential; the case that wins on the merits and loses on chain-of-custody challenges is the case where the documentation discipline failed.
Where it shows up
Operationally relevant for: criminal-defense and civil-litigation contexts where evidence admissibility is contested, corporate-investigation work where the result may flow to litigation or regulatory enforcement, journalism source-protection scenarios where leaked documents must be authenticated without compromising the source identity, and (for individual readers) the stalkerware-detection or device-compromise scenario where the evidence the user preserves may matter in a future protective-order or custody case. The Predaxia editorial frame: most individual readers do not produce courtroom-tier evidence routinely, but the small number of moments when they need to (a stalkerware finding, a doxxing incident, a device-compromise during separation) are the moments where the discipline learned in advance changes the outcome.
What you can change today
Build a one-page chain-of-custody template you can use when you discover something that may matter later. Sheet of paper or encrypted note: date and time of discovery (with timezone), location, what was found (described factually, not interpreted), what was the condition (photographed before any change, hashed if digital), what you did with it (where it is now stored, who else has touched it). For digital evidence: take the screenshot or forensic copy first, hash it (sha256sum on Linux or macOS, Get-FileHash on Windows), record the hash, and only then make working copies for analysis. The discipline takes minutes; the value is that the evidence remains useable in a proceeding 18 months later.
Related articles
- Three breaches in ten days. In two of them, the attacker never wrote a line of code.
- You don’t have to be a suspect. You just have to have been there.
- Digital security for journalists in 2026: the complete operational guide.
- The US government now requires visa applicants to make their social media public.