Process and analysis
What is Chain of custody?
The documented record of who collected evidence, who handled it and how it was stored, showing it was not altered along the way.
Chain of custody is the documented history of a piece of evidence from collection onward: who collected it, when, how, who has had access since, and how it was stored. For digital evidence it usually includes cryptographic hashes taken at collection.
Without it, evidence can be challenged as possibly altered. Even when a case is unlikely to reach court, keeping a chain of custody makes findings defensible to regulators, insurers and internal review.