Share:
Glossary Forensics

Chain of custody

The chain of custody is the documented record of who handled a piece of evidence, when, where and why, from collection to presentation.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

A complete chain shows the evidence was not altered or swapped, which is what makes it credible in court or in an internal investigation. In digital work it usually includes a Hash taken at acquisition and re-checked later to prove the data is unchanged, plus notes of each transfer and storage location.

Try these tools

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text, computed locally with the Web Crypto API.

File Checksum Calculator

Calculate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 checksums of one or many files and compare them with a published value.

See also

  • Glossary Forensic image
    A forensic image is an exact, bit-for-bit copy of a storage device or file system that investigators analyse instead of the original.
  • Glossary Hash
    A hash is the fixed-length fingerprint a hash function computes from any input; the same input always gives the same hash.
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard