Documented record tracking evidence handling from collection through analysis and presentation.
Chain of custody is the documented record of who handled evidence, when, and what they did with it. Maintaining chain of custody ensures evidence integrity and admissibility in legal proceedings. Every transfer, access, or action on evidence must be documented. Chain of custody applies to physical evidence (hard drives, devices) and digital evidence (forensic images, logs). Broken chain of custody can render evidence inadmissible.
Why It Matters
The DSC Perspective:
If incidents may lead to legal action, chain of custody is critical. Establish evidence handling procedures before incidents occur. Poor evidence handling can undermine prosecution or civil cases.