Chain of Custody: A Practical Guide for Small Teams

What chain of custody actually means

Chain of custody is the documented history of a piece of evidence, from the moment it is collected to the moment it is presented. It answers four questions for every item, at every point in its life:

• What is it, precisely?
• Where did it come from, and where has it been kept?
• Who has had it, and who handed it to whom?
• When did each of those things happen?

If you can answer those four questions for a piece of evidence with an unbroken record, the chain is intact. If there is a gap — a period where nobody can say where it was or who had it — the chain is broken, and the other side will argue the evidence could have been tampered with, swapped or planted.

Why cases collapse without it

The point of chain of custody is not bureaucracy for its own sake. It is to defeat one specific attack: "How do we know this is the same document/phone/sample that was collected, and that nobody altered it?"

Without a chain, you cannot answer that question, and you don't have to be guilty of anything for it to sink you. The mere possibility of tampering, once raised, is often enough to have evidence excluded or its weight destroyed. Perfectly honest investigators lose perfectly good evidence this way every day — not because they did anything wrong, but because they cannot prove they didn't.

The simple procedure

You do not need a lab or expensive kit. You need discipline and a form. Here is a procedure a two-person team can run:

1. Collect deliberately. When you take an item into evidence, record it immediately: what it is, a unique reference number, exactly where and when you got it, and from whom. Photograph it in place before you move it if you can.

2. Label it. Give every item a unique identifier and mark it (or its container) with that identifier. Vague descriptions — "the letter," "the phone" — cause chaos when you have twenty items.

3. Secure it. Store it somewhere access-controlled, where only named people can reach it. A locked drawer with a key held by one person beats a shared cupboard. For digital evidence, a private, access-logged store beats a shared drive.

4. Log every movement. This is the heart of the chain. Every single time the item changes hands or location, record it: who released it, who received it, the date and time, and the reason. A gap here is a gap in the chain.

5. Preserve the original; work from copies. Never work on the only copy of anything. For a document, keep the original secured and work from copies. For digital evidence, this is essential — which brings us to the special case.

Digital evidence needs one extra step

Physical evidence can be sealed in a bag. Digital evidence — a photo, a phone export, a spreadsheet, an email — can be altered without leaving a visible trace, so you need a way to prove a file hasn't changed. That tool is the hash.

A hash is a digital fingerprint: run a file through a hashing function and you get a short string of characters that is unique to that exact file. Change a single pixel or comma and the hash changes completely. So the moment you collect a digital item, you calculate and record its hash. Any time later, you can re-hash the file: if the hash still matches, the file is provably unaltered; if it differs, the file has changed. Recording the hash at collection is the digital equivalent of sealing and signing the evidence bag. (A companion guide covers chain of custody for digital evidence in more depth.)

A chain-of-custody form you can adapt

At minimum, a custody record for each item should capture:

• Unique item reference and description
• Date, time, place and source of collection
• Collector's name
• Storage location
• For digital items: the hash value and the algorithm used
• A movement log: date/time, released by, received by, purpose — one row per hand-over

Keep one record per item, add to it every time the item moves, and never delete a row — the history is the evidence of integrity.

The mistakes small teams make

• Starting late. Deciding to document custody only once a matter turns serious. By then the early history is lost. Treat everything as potential evidence from the start.
• Shared, unlogged storage. Evidence in a drawer anyone can open has no meaningful custody.
• Working on originals. Editing the only copy destroys the ability to show the original state.
• No record of who had it. "It was in the office somewhere" is not a chain.
• Gaps. Any unexplained period is the gap the other side will drive a truck through.

Proportion it to the matter

Not every scrap of paper needs full custody treatment, and pretending otherwise will grind a small team to a halt. Apply judgement: the more likely an item is to be contested, and the more it matters to the case, the more rigorous the custody. A minor supporting document can be handled lightly; the central piece of evidence deserves the full procedure. The skill is deciding early which is which.

Doing this without a filing-cabinet full of forms

Chain of custody is fundamentally a record-keeping discipline, and record-keeping done on loose paper is exactly what breaks down under pressure. Conectir keeps evidence in a private, access-controlled store, records what was added and when, and — for the report — produces a hash-chained audit trail that shows the evidence relied on is intact from collection onward. It builds the custody record as you work rather than asking you to reconstruct it later. If demonstrating evidence integrity matters to your cases, see how the evidence and reporting tools handle it.