RESOURCE 04 / CUSTODY

Chain of Custody Form and Field Guide

A blank custody form you can print from this page, and a field-by-field account of why each field is on it — what that field establishes, and what the gap costs when the record is put to a witness. The fields are ruled rather than typed, because a custody entry is written when the transfer happens or it is written from memory.

FORM: 5 sections · 6 transfer rows
GUIDE: 16 fields explained
COMPLETION: By hand, at the transfer
FORMAT: HTML · print · Save as PDF
STORED: Nothing · no inputs, no JS
ADVICE: Not legal advice

IN SHORT

A chain of custody record is the continuous, documented account of who held an item of evidence, when, and what they did with it. For digital evidence it tracks both the physical device and the forensic copy taken from it. Its purpose is narrow and important: to support the proposition that the material analysed is the material collected and that it has not changed since.

This is an educational template, not legal advice

The language on this page is generic drafting, published to be read and understood. No court has approved it, it is not this firm’s filed language in any matter, and it has not been accepted or rejected in any specific proceeding. Nothing here is tailored to your case, your forum, or the order that governs your matter, and using it unadapted is the error the page exists to help you avoid.

Firms, laboratories and agencies use custody forms with different fields, and where an accreditation regime or an agency policy applies, that form governs rather than this one. Use this as a floor and a reference for what each field is for — not as a replacement for a documented procedure your own organisation can stand behind.

Reading it creates no attorney–client relationship and no expert-engagement relationship. Check the rules, standing orders, local practice and case law of your own forum before relying on any of it.

The blank form

1EVIDENCE IDENTIFICATION

MATTER / CAPTION

MATTER NUMBER

ITEM NUMBER

DESCRIPTION OF ITEM

MAKE AND MODEL

SERIAL NUMBER

CAPACITY

POWERED STATE ON RECEIPT(on / asleep / off)

CONDITION ON RECEIPT(damage, open case, broken seal, anything unusual)

PHOTOGRAPHS TAKEN(y / n, reference)

RECEIVED FROM(name, role)

2ACQUISITION AND VERIFICATION

ACQUIRED BY(print name)

DATE AND TIME(state the time zone)

LOCATION OF ACQUISITION

ACQUISITION METHOD

WRITE PROTECTION USED(hardware / software / live, and why)

TOOL AND VERSION

IMAGE FORMAT(raw / container / logical)

SEGMENTS AND TOTAL SIZE

HASH ALGORITHM

ACQUISITION HASH VALUE

VERIFICATION HASH VALUE

VERIFIED BY, AND DATE

NOTES ON ANY DISCREPANCY

3CUSTODY TRANSFER LOG

Blank custody transfer log with six rows, to be completed by hand at the point of each transfer.
NO.	RELEASED BY (PRINT & SIGN)	RECEIVED BY (PRINT & SIGN)	DATE & TIME, WITH TIME ZONE	PURPOSE OF TRANSFER	STORAGE LOCATION / SEAL NO.
1
2
3
4
5
6

4STORAGE AND SEAL

STORAGE LOCATION

CONTAINER / EVIDENCE BAG NUMBER

SEAL NUMBER APPLIED

SEAL INTACT ON RECEIPT(y / n)

OPENED BY, AND DATE

ACCESS RESTRICTIONS

5DISPOSITION

DISPOSITION(returned / retained / destroyed)

DATE(state the time zone)

AUTHORISED BY

RELEASED TO(name, role)

FINAL VERIFICATION HASH, IF PERFORMED

NOTES

Complete by hand at the point of each transfer. Nothing on this page is an input field and nothing you write is stored anywhere — the form is markup so that it prints, and so that a firm wanting different fields can adapt it.

What the record is actually for

A custody record does not prove anything about the contents of the evidence. It supports the much narrower proposition that the thing analysed is the thing collected.

That narrowness is worth holding onto, because both sides of a matter tend to overstate it. A complete custody record does not make a finding reliable, and it says nothing about who put a file on a device or what a timestamp means. A gap in the record does not make the evidence inadmissible either. What a gap reliably does is change the subject: instead of arguing about what the artifacts show, the parties argue about whether the artifacts are what they are said to be. That is a worse argument to be having whichever side of it you are on, and it is entirely avoidable with a clipboard.

The record also carries two things at once, which is where digital evidence differs from a physical exhibit. There is the device, which moves between people and rooms, and there is the forensic image, which is copied, stored, and analysed. The hash value is what links them: recorded at acquisition and recomputed before analysis, it establishes that the copy has not changed since it was made. It establishes nothing else, and the distinction between integrity of a copy and authenticity of content is the one most often blurred in testimony.

Where the record meets the rules

Authentication of an electronic record under FRE 901 asks for evidence sufficient to support a finding that the item is what its proponent claims, and for digital evidence the custody record and the acquisition hash are a large part of how that showing is made. FRE 902(14)provides for self-authentication of data copied from an electronic device where the copy is authenticated by a process of digital identification and certified by a qualified person — so the hash and the certification do work the custodian would otherwise do live. Neither rule cures a gap: a certification describes a process that was followed, and if the record does not show that it was, the certification is an assertion about an undocumented step. On a contested acquisition the custody form is not paperwork wrapped around the evidence. It is part of the evidence.

The field guide

Every field on the form is there because its absence causes a specific, identifiable problem. This is that mapping, field by field: what it establishes, and what the gap costs.

FIELD	WHAT IT ESTABLISHES	WHAT A GAP IN IT COSTS
Item number	Gives every device and every image a single identifier used in the custody record, the examination notes, the exhibit list, and the report.	Without one, the report and the custody record cannot be matched to each other, and a question about which of three identical laptops was examined has no answer on the paper.
Make, model, serial number	Ties the record to a physical object rather than to a description. The serial is what distinguishes two identical devices.	A record of 'laptop, black' is consistent with any laptop. If the device is later disputed, nothing in the record identifies the one that was examined.
Condition on receipt	Records damage, an open case, a missing screw, a device already powered on, or a broken seal — at the moment it first came into custody.	Every later question about tampering or damage becomes unanswerable, and whoever received the item next inherits the suspicion.
Powered state on receipt	Whether the device arrived running, asleep, or off decides whether volatile data existed to capture and whether an encrypted volume was mounted.	A decision not to capture memory looks like an oversight rather than a consequence of the device's state, and an encryption question has no baseline.
Acquired by	Names the person who performed the acquisition, who is the witness who can testify to how it was done.	The acquisition has no author. If that person has left the firm, nobody can say who to call, and the examination inherits an unsupported step.
Date, time, and time zone	Fixes when the image was taken, which bounds what it can contain, and records the zone in which the entry itself was written.	A custody timeline expressed in mixed or unstated zones cannot be reconciled with system timestamps — the single most common reason a clean examination produces a confused timeline.
Acquisition method and write protection	Records how the copy was made and what prevented writes to the original: a hardware write blocker, a software block, or an acquisition performed live and why.	The question 'did your process alter the original' has no documented answer, which is the point at which the whole acquisition is being defended from memory.
Tool and version	Identifies the software that produced the image and the hash, which is what makes the step reproducible and what a known defect advisory attaches to.	A value cannot be tied to the thing that produced it. If the version had a known parsing defect, nobody can now tell whether it applied.
Image format and segment count	Records whether the output is a raw image, a forensic container, or a logical evidence file, and how many segments it was written to.	A missing segment is discovered when the image is opened for analysis rather than when it is created, and the original may no longer be available.
Hash algorithm and acquisition hash	The value computed at acquisition. It is the reference every later verification is measured against.	There is nothing to verify against. The copy can no longer be shown to be unchanged since it was made, which is the specific thing a hash establishes.
Verification hash, verified by, date	Records that the hash was recomputed and matched, by whom, and when — usually before analysis begins.	A matching value is asserted rather than recorded. This is the most commonly empty field on an otherwise complete form.
Released by and received by, with signatures	Each transfer has two people and both are named, so custody is continuous rather than inferred.	A gap in the sequence. The record shows the item in two places with nobody accountable in between, which is the classic custody challenge.
Purpose of transfer	Says why the item moved — acquisition, analysis, storage, return, transport to a deposition.	A movement with no reason on the record invites the question of what was done with the item while it was out, and the answer is reconstructed rather than documented.
Storage location and seal number	Identifies where the item sat between transfers and the number on the seal that was intact when it was next opened.	The intervals between transfers are unaccounted for. Custody is only continuous if the storage is part of the record.
Seal intact on receipt	A single yes or no, recorded by the person who opened the container.	The one question a custody challenge always asks has no recorded answer, and the person who could have answered it did not write it down.
Disposition and final hash	Records what happened to the item at the end — returned, retained, destroyed — with authority, date, and a final verification where one was performed.	The record ends mid-matter. Where the original has been returned, there is no documented state at the point it left custody.

The third column is the reason the field exists. Where a field looks like bureaucracy, it is usually because the failure it prevents has not happened to the reader yet.

The four gaps that recur

The verification hash, recorded nowhere. The acquisition value gets captured because the tool prints it. The recomputation before analysis is the step that ends up being asserted from memory, which is exactly the step a hash exists to make checkable.
Time zones unstated, or mixed across entries. The custody timeline then cannot be reconciled with the system timestamps inside the evidence, and reconciling those two is routine work in every examination. See time zone offset and clock drift.
Storage unaccounted for between transfers. A sequence of hand-offs with nothing in between is not a continuous chain. The seal number and the storage location are what close the intervals.
The device left running while the paperwork is arranged. Not a form problem, but the one that costs the most: ordinary use consumes unallocated space, prunes shadow copies, and rolls the capped usage artifacts over. The custody record will faithfully document the degradation.

How the acquisition itself is performed and what a write blocker does and does not guarantee are covered on the computer forensics page; the custody questions a witness should expect are topic C of the deposition outline.

Questions counsel ask

What is a chain of custody for digital evidence?

The documented, continuous record of who had an item of evidence, when, and what they did with it, from the moment it came into custody to its final disposition. For digital evidence it covers two things at once: the physical object, and the forensic copy taken from it. Its purpose is to support the proposition that the material analysed is the material collected and that it has not changed, which is a foundation question rather than an opinion.

Does a gap in the chain of custody make evidence inadmissible?

Not automatically, and treating it that way overstates it in both directions. A gap goes to the weight of the evidence and to whether the proponent can establish that the item is what it is claimed to be. What it reliably does is shift the argument from what the evidence shows to whether the evidence is what it is said to be — which is a much worse place to be arguing from, whichever side you are on.

Why record a hash value on a custody form?

Because it is the only field that can be checked later. A recorded acquisition hash, recomputed and matched, establishes that the copy has not changed since it was made. That is a narrow and valuable thing. It does not establish what was on the device before acquisition, that the collection was complete, or who put any file there — and an examiner who describes it as proving authenticity of content has overstated it.

Which field is most often left blank?

The verification hash, with its 'verified by' and date. The acquisition value is usually captured because the tool prints it; the recomputation before analysis is the step that gets asserted in testimony rather than recorded at the time. The second most common is the storage location and seal number between transfers, which is what makes custody continuous rather than a sequence of hand-offs with unaccounted intervals.

Do the time zones on a custody form matter?

They matter more than almost anything else on the sheet. A custody timeline written in mixed or unstated zones cannot be reconciled with the system timestamps inside the evidence, and reconciling those two timelines is a routine part of the examination. It is the most frequent reason a technically clean acquisition produces a confused chronology that has to be untangled under oath.

What this form does not do

A completed form is not a defensible custody record. It is the documentation of one. Whether custody was in fact continuous depends on what people did, and a form completed after the fact documents a reconstruction rather than a chain.
It is not an accredited or agency form. Where a laboratory accreditation regime, an agency policy, or a court’s own practice prescribes a form, that one governs. This is a generic floor.
It does not establish authenticity of content. A matching hash shows a copy has not changed. It says nothing about what was on the device before acquisition, whether the collection was complete, or who put any file there.
It does not tell you whether a gap is fatal, and it is not a collection protocol. Whether a gap matters depends on the forum, the posture, and what other foundation is available; the form tells you where the gap is. Deciding what to acquire, in what order, and by what method is the examination’s design, and no form substitutes for it.

ACQUISITION AND CUSTODY

Where a device needs to come into custody defensibly — imaged, hashed, sealed, and documented from the first transfer — that is usually arranged without any substantive discussion of the matter. Conflicts come first.

START A CONFLICTS CHECK→

DIRECT → info@lawandforensics.com·855-529-2466

A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.

Other resources

RESOURCE 01 / PRESERVATION
Evidence Preservation Letter
A generic preservation letter, clause by clause, with each clause paired against what it actually preserves and what it leaves exposed. The annotation is the product.
RESOURCE 02 / DEPOSITION
Forensic Expert Deposition Outline
A topic-organised question outline for the deposition of an opposing digital forensics expert — qualifications, scope, tool validation, reproducibility, timestamps, custody, and what they were never asked to do.
RESOURCE 03 / DISCLOSURE
Rule 26 Report Checklist
The six statutory elements of a retained expert's report quoted verbatim, then — counted separately, because the rule imposes six and not sixteen — the practice points that decide whether the six are met.
RESOURCE 05 / PROTECTIVE ORDER
Source Code Inspection Protocol
Model protective-order terms for source code review, each paired with the failure mode it prevents — including the two terms that are routinely omitted and routinely fought over later.
RESOURCE 06 / DILIGENCE
Expert CV Red Flags
How to read a digital forensic expert's CV and testimony list for what they do not say — roles in place of examinations, curated publication lists, and what a missing four-year list means.

Attorney advertising / expert services. This page publishes an educational template and general information about forensic practice and the procedural rules that govern expert evidence. It is not legal advice, it does not create an attorney–client or expert-engagement relationship, and it is not a substitute for checking the rules, standing orders, and case law of your own forum. Prior results do not guarantee a similar outcome.