The Art of Chain of Custody

The evidence is not the file, but its path

An Excel file with customer prices, found in the private cloud storage of an employee who has left. Unambiguous in content. And yet the opposing party’s first question is not: What does it say? But: Where does the file come from, who had it in their hands, and how do you know it has not been altered?

These are exactly the questions the chain of custody answers. If you cannot answer them, evidence turns into an allegation with an attachment.

What a chain of custody is

The US National Institute of Standards and Technology (NIST) defines the chain of custody as chronological documentation that records the seizure, custody, control, transfer, analysis and disposition of physical or electronic evidence [1]. The IETF guideline RFC 3227 puts it more practically: you must be able to describe clearly how evidence was found, how it was handled and everything that happened to it [2].

In concrete terms, this means recording for every item of evidence and every step:

• Who preserved, handed over, analysed?
• What exactly was preserved – device, mailbox, file – and with which hash value?
• When and where – including the time zone?
• How – with which method, which tool, which version?
• Why – on what basis and under which mandate?

The hash value is the digital fingerprint. If it matches at preservation, at every handover and at presentation, it is proven that the data has not changed.

Why digital evidence is especially vulnerable

With paper there is an original and copies. With files there is not: a copy with an identical hash value is the file. Conversely, every conversion changes the file, even if you cannot see it. Schreiber and Kettiger show in the Swiss judges’ journal that printing an email or converting it to PDF drops the header and the rest of the source code – precisely the information that allows sender, server and time to be verified [6]. Even so, this form is widespread today [6].

This leads to a simple rule: every change must be justified and documented – otherwise it becomes a point of attack.

How to recognise a clean chain of custody

ISO/IEC 27037 requires four properties when handling digital evidence: auditability, repeatability, reproducibility and justifiability [3]. Every action must be traceable by a qualified third party; every deviation from standard procedure must be justified.

The UK ACPO principles have long been regarded as the professional benchmark [4]. Their core in four points: no action may change data that will later be relied on. Anyone who has to access original data must be competent to do so and able to explain their actions. An audit trail must be kept of all steps so that an independent third party can reach the same result. And overall responsibility lies with the person in charge of the case.

RFC 3227 adds two principles that are often violated in practice: preserve first, then analyse – and never work on the evidence copy, but on a further working copy [2].

For use in proceedings in Switzerland, the Civil Procedure Code [7] and the Criminal Procedure Code [8] are particularly relevant. How much weight electronic evidence carries depends in practice largely on whether its authenticity, integrity and origin can be traced [6] – which is exactly what a clean chain of custody delivers. How evidence should be introduced in specific proceedings is for your law firm to assess.

What regulators expect

Regulators mainly check the format. In its Data Delivery Standards, the US Securities and Exchange Commission (SEC) requires electronic files to be delivered in their native format. Where data is deduplicated, the metadata of the duplicates – such as custodian and storage location – must be preserved and delivered [9]. The US Federal Trade Commission (FTC) provides a dedicated field for the hash value of the original file in its production guidelines [10].

In Switzerland, FINMA appoints investigating agents for complex matters [11]. Their findings, too, are only as robust as the derivation of the data they rely on.

The chain of custody at a glance

The EDRM Collection Standards note that drag-and-drop copies change metadata, create no automatic audit trail and are hard to reproduce [5]. Anyone collecting this way must expect to have to collect the data again in a forensically sound manner later – if it still exists by then.

What helps in practice

Schreiber and Kettiger recommend, among other things, for handling electronic evidence [6]:

• Identify evidence on receipt and before every transmission by its hash value – not by its file name.
• Store and transmit evidence so that it cannot be altered unintentionally.
• If a conversion is unavoidable, list both versions in the evidence register: the source file and the submitted file, each with file name, format and hash value (e.g. SHA-256) – and the reason for the change.

Add to this what distinguishes every good investigation: documentation is created during the work, not afterwards. A record reconstructed after the fact is itself a point of attack.

Conclusion: five questions for every chain of custody

1. Can every item of evidence be traced back to its source without gaps?
2. Do the hash values match at preservation, handover and presentation?
3. Is every person who had access documented by name?
4. Is every change – conversion, filtering, deduplication – justified and recorded?
5. Could an independent expert repeat the procedure and reach the same result?

Wherever one of these questions has to be answered “no”, the weakness lies not in the content but in the path. The chain of custody cannot be created after the fact. It is established with the first step – or not at all.

This article is for general information only and does not constitute legal advice. For a legal assessment of your case, please consult a law firm.

Sources

[1] National Institute of Standards and Technology (NIST), OSAC Lexicon: Chain of Custody Records – https://www.nist.gov/glossary-term/20081

[2] Brezinski, D. / Killalea, T.: RFC 3227 – Guidelines for Evidence Collection and Archiving, IETF, 2002 – https://www.rfc-editor.org/rfc/rfc3227

[3] ISO/IEC 27037:2012 – Guidelines for identification, collection, acquisition and preservation of digital evidence – https://www.iso.org/standard/44381.html

[4] Association of Chief Police Officers (ACPO, now National Police Chiefs’ Council): ACPO Good Practice Guide for Digital Evidence, Version 5, 2012

[5] EDRM (edrm.net): EDRM Collection Standards – https://edrm.net/resources/frameworks-and-standards/edrm-model/edrm-stages-standards/edrm-collection-standards/

[6] Schreiber, C. / Kettiger, D.: Elektronische Beweismittel – neue Herausforderungen, in: «Justice – Justiz – Giustizia» 2024/2 (Richterzeitung) – https://www.advo-schreiber.ch/dok/Schreiber_Kettiger_Richterzeitung_2024_2_el_Beweismittel.pdf

[7] Swiss Civil Procedure Code (CPC), SR 272 – https://www.fedlex.admin.ch/eli/cc/2010/262/en

[8] Swiss Criminal Procedure Code (CrimPC), SR 312.0 – https://www.fedlex.admin.ch/eli/cc/2010/267/en

[9] U.S. Securities and Exchange Commission: Data Delivery Standards, Rev. 08/2026 – https://www.sec.gov/files/sec-dds-aug-2026.pdf

[10] U.S. Federal Trade Commission: Preparing Native Files (Bureau of Competition Production Guide) – https://www.ftc.gov/tips-advice/competition-guidance/bc-production-guide/preparing-collections/native-files

[11] Federal Act on the Swiss Financial Market Supervisory Authority (FINMASA), SR 956.1 – https://www.fedlex.admin.ch/eli/cc/2008/736/en

Content from edrm.net is licensed under Creative Commons Attribution 4.0 International.