CyberGuard dictionary / Incident Response
Chain of Custody
Chain of custody is the documented history of who collected, held, transferred, and examined an item of digital evidence.
In simple terms
If evidence changes hands, the team should be able to say who had it, when, where it was stored, and what was done.
Technical explanation
A custody record links an identified evidence item to collection time, handlers, transfers, storage controls, and integrity checks. It supports traceability but does not by itself prove that the original collection was complete.
The record should show who possessed evidence, when, where it was stored, and what integrity checks were performed. Every transfer should be documented so later reviewers can reconstruct handling.
Examples in practice
An investigator signs out an encrypted drive image to a forensic analyst, who records the handoff and verifies its hash before analysis.
The analyst receives a drive image with a documented hash, verifies the value, and records the transfer into controlled storage. A later examiner repeats the verification before analysis.
Why it matters
A clear handling record helps preserve confidence in findings and reduces disputes about tampering.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.