- [Narrator] When evidence is used in court
or in another formal setting,
both parties involved in a dispute
have the right to ensure that the evidence presented
has not been tampered with during the collection,
analysis, or storage process.
We've already discussed how hashing can be used
to verify that digital evidence has not changed.
The chain of custody also plays an important
role in ensuring the authenticity of evidence.
The chain of custody, also known as the chain of evidence,
provides a paper trail that tracks each time
someone handles a piece of physical evidence.
In the case of digital forensics,
this might include the original hard drive
or other primary evidence collected
by investigators and used for later analysis.
When collecting physical evidence,
the evidence should always be placed
in an evidence storage bag or other container
that is labeled with the date, time,
and location of collection,
the name of the person collecting the evidence,
and the contents of the storage bag.
It should then be sealed with a tamper-resistant seal
that would show if someone opened the container.
This is the beginning of the chain of custody.
Each piece of evidence should then be accompanied
by an evidence log that records important events
that happen in the life cycle of the evidence.
These events include the collection of the evidence,
the transfer of that evidence between investigators,
the storage of the evidence,
and any opening or resealing of the evidence container,
or any other important event that occurs.
Each time an investigator records an entry
in the evidence log, that entry should include
the name of the person performing the action,
the current date and time, the purpose of the action,
and the nature of the action being taken with the evidence.
Evidence logs are incredibly important
and must be available to present in court.
If an opposing attorney can show a failure
to appropriately maintain the evidence log,
this is a situation known as
a breach of the chain of custody.
In cases where the party presenting evidence
cannot prove a satisfactory chain of custody,
the evidence may not be admissible in court.