Which principle of evidence collection states that access to evidence must be tracked from the time it is seized through its use in court?

The chain of custody is the fundamental forensic and legal principle that provides a chronological paper trail of evidence. It documents every person who has handled the evidence, the date and time of collection or transfer, and the purpose for the handling. This unbroken record, from the moment of seizure until presentation in court, is crucial for demonstrating that the evidence has not been tampered with or altered, thereby ensuring its integrity and admissibility in legal proceedings.

A. Evidence record: This is a general term for a log or file about a piece of evidence. The chain of custody is the specific, formal process of documenting the entire handling sequence.

C. Event log: An event log is a file that records events occurring in an operating system or software application. It can be a source of evidence but is not the principle of tracking evidence.

D. Audit log: An audit log, or audit trail, is a security-relevant record of system activities. Like an event log, it is a type of evidence, not the procedure for managing its handling.

1. National Institute of Standards and Technology (NIST). (2006). Guide to Integrating Forensic Techniques into Incident Response (Special Publication 800-86). Section 3.3.2, "Chain of Custody," states, "A chain of custody form is used to document the seizure of evidence... Each time the evidence changes hands, the transfer should be recorded on the chain of custody form."

2. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Chapter 2, "Forensic Analysis Process," discusses the importance of the chain of custody in the collection phase, defining it as the process to "document the location of evidence and who has had access to it."

3. Kebande, V. R., & Venter, H. S. (2017). A model for digital chain of custody. Australian Journal of Forensic Sciences, 49(5), 543-561. The abstract states, "The chain of custody (CoC) is a crucial process that ensures the integrity of evidence is maintained from the time of seizure until it is presented in a court of law." https://doi.org/10.1080/00450618.2016.1249578

4. George Mason University. (n.d.). CFRS 660: Digital Forensics. Course materials on "Evidence Handling" define Chain of Custody as "A record of every person who has handled the evidence, the date/time it was handled, and what was done with it."