Chain of custody

Chain of custody is the documented, unbroken record of evidence handling from the moment it is collected until it is presented in court. Every transfer is logged: who took possession, what exactly was handed over, when the transfer happened, where the evidence was stored, and why it moved. For digital evidence this pairs with hashing: a forensic image is hashed at acquisition, and the same hash is verified later to prove the copy has not changed.

The rule that decides questions is that the record must be continuous. A single undocumented gap (an evidence bag left unattended, a transfer nobody signed for) breaks the chain, because the opposing party can argue the evidence was altered during the unaccounted period. Courts do not require proof that tampering actually happened; the mere opportunity, unrecorded, is enough to have evidence ruled inadmissible, regardless of what that evidence shows.

Exam relevance: if a scenario mentions evidence admissibility, documenting who handled a disk, or a gap in the handling log, the answer is chain of custody. It belongs to the forensics side of incident management, and the exam expects custody documentation to start at collection, not when lawyers get involved. Contrast it with evidence integrity itself: hashing proves the data is unchanged, while chain of custody proves who could have touched it and when.