Chain of custody
Chain of custody in eDiscovery is the documented record of every person who handled a piece of evidence and every transfer it went through, from collection to production. Hash values are computed when the data is acquired and re-verified afterwards, so the producing party can show the data is what it claims to be and was not altered along the way.
Also called: custody log · chain of custody form · evidence log · forensic chain of custody · custody documentation
Updated September 6, 2026
How does chain of custody work?
Chain of custody is a paperwork discipline, not a technology. Every time evidence changes hands or location, someone records who had it, who has it now, when the handover happened and what was verified at the time. The eDiscovery version adds one thing the physical-evidence version cannot have: a hash value computed at acquisition, which turns “it looks the same” into a check anyone can repeat.
The sequence is: acquire the data with a method that does not alter it; compute a hash of the acquired image or file set immediately; record the acquisition in a custody form; transfer to processing; recompute and compare the hash on receipt; log the comparison. Every later movement (to the review platform, to an expert, to a production volume) is another row in the log.
Hashes carry through the whole workflow, which is what makes the record continuous rather than a set of assertions. The same file hash that verifies an acquisition also drives deduplication and de-NISTing in processing, and often travels to the other side as an MD5 or SHA-1 field in the DAT file.
The record is rarely needed. When it is needed, it is needed in a motion: an authenticity challenge, or a spoliation allegation where the question is what existed at collection and what happened to it since. A log built after the fact is not evidence of anything.
What does chain of custody look like in practice?
A custody log for one collection:
| Date (UTC) | Event | From → To | Hash verified |
|---|---|---|---|
| 2024-03-14 09:12 | Targeted collection, M365 mailbox | Custodian J. Mendez → collection tool | SHA-256 recorded at acquisition |
| 2024-03-14 15:40 | Transfer to processing | Collection examiner → processing queue | Recomputed, matched |
| 2024-03-18 11:05 | Promotion to review set | Processing → review platform | Per-file hashes carried in field |
| 2024-06-02 16:20 | Production VOL003 export | Review platform → production media | Volume manifest hashed |
Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007), is the standard reference on authenticating ESI, and treats a hash value as a distinctive characteristic capable of supporting authentication under Rule 901(b)(4).
How does chain of custody show up on an eDiscovery invoice?
Chain of custody is generated by the collection step, and that is where it is billed: collection fees, charged per custodian, per source, or at hourly forensic rates. The Fee Field Guide’s note is worth holding onto: collection from standard cloud sources such as Microsoft 365, Google Workspace and Slack is now largely API-driven and automated, so forensic hourly rates for routine cloud pulls deserve scrutiny, while genuine device imaging is skilled work that reasonably costs skilled-work money.
Documentation itself is sometimes billed as project management hours. It should not be optional at any price: a collection without a custody record is cheaper only until it is challenged.
Ask what the rate is per custodian and per source, whether standard cloud connectors are automated or billed as forensic time, and whether the custody documentation and acquisition hashes are delivered as part of the collection or as an extra.
Sources
- Fed. R. Evid. 901(a) and 901(b)(4), quoted in part.
- Fed. R. Evid. 902(13) and 902(14), and the 2017 Advisory Committee Notes.
- Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007).
- NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response.
- ISO/IEC 27037:2012, Guidelines for identification, collection, acquisition and preservation of digital evidence.
- Fee categories: the Fee Field Guide dataset.
Related terms
Hash value · Collection · Custodian · Litigation hold · Spoliation · Processing
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
Why does chain of custody matter if the data is authentic?
Because authenticity has to be shown, not assumed. Federal Rule of Evidence 901(a) requires the proponent to "produce evidence sufficient to support a finding that the item is what the proponent claims it is." A custody record with acquisition hashes is how that showing is made without calling everyone who touched the data. Rule 902(14), added in 2017, allows data copied from an electronic device to be self-authenticating when authenticated by a process of digital identification and certified by a qualified person. Hash comparison is the process the advisory committee had in mind.
Does self-collection break the chain of custody?
Not automatically, but it weakens the record. A custodian copying files to a folder typically rewrites system metadata, produces no acquisition hash, and leaves nobody able to testify to what was and was not copied. Where the collection may be challenged (key custodians, adverse employees, likely spoliation disputes) a defensible tool or a forensic examiner produces a record that a drag-and-drop cannot.
What does a chain of custody form record?
At minimum: the matter, the custodian and the source device or account; what was collected and by what method and tool, with version; the date, time and time zone; the acquisition hash and the algorithm used; the name and signature of the person who collected it; and then one row per transfer thereafter, from whom, to whom, when, by what means, and the verification hash on receipt.