What is a chain of custody?

The chain of custody is a critical legal and procedural document that provides a chronological record of the handling of evidence. It meticulously tracks the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. The primary purpose is to establish the integrity of the evidence by demonstrating that it has not been tampered with, altered, or substituted from the moment of its collection at the original location (e.g., crime scene) through its analysis at a forensic laboratory and its eventual presentation in court. This unbroken and documented trail is essential for the evidence to be considered admissible in legal proceedings.

B. This describes a search warrant, which is a legal authorization granted by a judge that permits law enforcement to search a specific location and seize evidence.

C. This refers to a log of system activity or a process list within an operating system, which could be a form of digital evidence itself, not the documentation tracking it.

D. This describes a preservation order or a similar legal injunction, which is a court order compelling a party to preserve evidence, not the record of its handling after seizure.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86: Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.4, "Maintaining the Chain of Custody," states, "A chain of custody form is a record of all individuals who have possessed the evidence item... It is critical to maintain a complete chain of custody to support the use of the evidence in legal proceedings."

2. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Chapter 2, "Forensic Analysis Process," Section "Document," discusses the importance of the chain of custody document to record who had the evidence and when, ensuring its integrity from seizure to trial.

3. Maras, M. H. (2014). Computer Forensics: Cybercriminals, Laws, and Evidence. Jones & Bartlett Learning. Chapter 6, "The Investigation of Computer-Related Crime," Section "Chain of Custody," p. 168, defines it as "the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of evidence."