Physical evidence has had a discipline for centuries: the sealed envelope, the log sheet, the signature at every handoff. Chain of custody exists because courts learned that evidence is only as credible as the account of everyone who handled it. Break the account, and the object in the bag stops meaning anything.
Digital evidence needs the same discipline — and mostly doesn't get it.
What the chain has to answer
Strip away the ceremony and a chain of custody answers four questions, continuously, from collection to presentation:
- What exactly was collected? Not roughly — exactly, to the byte.
- Who has had it since, and when?
- What was done to it — moved, copied, examined, sealed?
- Is what we're looking at now the same thing that was collected then?
A folder of files on someone's laptop answers none of these. It cannot say what the files looked like at collection, who opened them since, or whether today's copy matches the original. Every one of those silences is a door the opposing party can walk through.
The digital version, done properly
The mechanics translate cleanly once you take them seriously:
Fingerprint at origin. Each file is hashed the moment it is produced, before it travels anywhere. The hash — a short string that changes completely if any byte of the file changes — is the digital equivalent of sealing the envelope at the scene, not back at the office.
Events, not narrative. Every action becomes a recorded event: capture, transfer, integrity check, storage, sealing, access, download. The record is written as things happen, not reconstructed later from memory for an affidavit.
Links, not a list. Each event carries a cryptographic reference to the event before it, forming a chain. Insert, delete, or reorder anything and the links stop matching. This is what "tamper-evident" means concretely: alterations are not forbidden by policy — they are visible by construction.
A seal at the end. When collection finishes, the record is closed with a final fingerprint covering everything. From then on, there is a single number that the whole history must answer to.
Verification by outsiders. The decisive property. A chain that only the vendor can vouch for merely relocates the trust problem. A proper chain can be exported and re-verified — every hash recomputed, every link rechecked — by an expert who has no relationship with anyone involved.
Why this matters before anyone attacks
Most digital evidence is never formally challenged. But the cases that matter are the ones where it is — and by then the chain either exists or it doesn't. Custody cannot be added retroactively; a history written after the fact is precisely what the discipline exists to prevent.
The envelope and the log sheet were never about paperwork. They were about making the account of the evidence stronger than anyone's interest in doubting it. Digital evidence deserves the same — with the advantage that mathematics, unlike signatures, can be checked by any expert, anywhere, forever.