Glossary term
Chain of Custody
Chain of custody is the documented record of every person who handled an evidence item, every transfer between custodians, and every change in storage location, from intake through analysis to archive or release.
Chain of custody is the foundation of forensic admissibility. A break in the chain (an unaccounted-for time period, an undocumented transfer, an uninspected seal) gives opposing counsel an opening to challenge the evidence.
We document chain of custody from the moment of contact with the device. The intake form records date, time, location, examiner receiving, and the device's condition. A tamper-evident seal goes around the device. Transport to the lab is documented with signatures. Every subsequent handling event (acquisition, analysis, return to storage) is logged with timestamp and examiner.
Hash values play a supporting role. Each working copy is hash-verified before analysis. Any mismatch is investigated and documented before work continues.
For Canadian counsel, a clean chain of custody record is what makes the underlying evidence admissible under section 31.1 of the Canada Evidence Act. We can produce a chain-of-custody affidavit on request.