An evidence log is a written record that tracks every item of evidence in an investigation from the moment it is collected until it is presented in court or destroyed. Each entry documents who handled the item, when, where, and why. Without that record, even strong evidence can be challenged or excluded, because no one can prove the item wasn’t altered, swapped, or contaminated between the scene and the courtroom. The log is what turns a physical object or a digital file into something a judge and jury can rely on.
What Goes Into an Evidence Log
Every entry answers the same five questions: who, what, when, where, and why. The specific fields vary by agency, but the pattern holds across them.
The U.S. Fish and Wildlife Service’s Evidence Storage Log is a useful example of what a working log looks like. Each item receives a sequential log entry number that acts as a unique reference for cross-referencing transfers in and out of storage. The entry also records the investigative file number, the date and time of the transfer, and the name of the person from whom the evidence was seized.1U.S. Fish & Wildlife Service. Procedures for Evidence Collection, Handling, and Storage
From there, the log describes the items being stored, usually with individual tag or item numbers so that anything removed later can be identified on its own. The transferring officer’s name is printed, and the evidence custodian signs to confirm receipt. A comments field captures context the standard fields don’t, such as why an item was removed or whether it was sent to a forensic lab and returned.1U.S. Fish & Wildlife Service. Procedures for Evidence Collection, Handling, and Storage
The process starts the moment evidence is collected. Each item is assigned a unique identifier, packaged, and logged with an initial entry documenting who collected it, when, and where. From that point on, every transfer triggers a new entry. When items move into or out of storage, the custodian records the direction of the transfer, the date and time, and signs to confirm custody changed hands.1U.S. Fish & Wildlife Service. Procedures for Evidence Collection, Handling, and Storage
Documentary evidence follows the same logic. When Department of Labor enforcement investigators take possession of original records, they issue a signed, itemized, and dated Document Receipt. When documents are returned, the receiving party signs a Return of Documents form. Both signed copies stay in the case file, creating a paper trail that accounts for every handoff. Physical items such as paper evidence, USB drives, and removable media must be logged and tracked under agency policy, and transmittals between offices require a memo identifying in detail every item being moved.2U.S. Department of Labor. Enforcement Manual – Collection and Preservation of Evidence
Why the Log Matters: Chain of Custody
The reason agencies maintain logs at this level of detail is to establish what is called the chain of custody. The National Institute of Justice defines it as “a record of individuals who have had physical possession of the evidence” and notes that “documentation is critical to maintaining the integrity of the chain of custody.”3National Institute of Justice. Chain of Custody of Evidence
An unbroken chain proves that no one had the opportunity to alter, contaminate, or swap a piece of evidence between collection and trial. When a prosecutor introduces a bag of narcotics at trial, the defense will ask how anyone can be sure it is the same substance taken from the scene. The log answers that question by showing every hand the bag passed through, every room it sat in, and every test it underwent.
A gap gives the defense an opening. If no one can account for where a blood sample was for three days, a judge may decide the sample isn’t reliable enough to admit. Even if it does come in, the gap becomes ammunition for cross-examination, and jurors notice. Cases often fall apart here, not because the evidence is weak, but because the paperwork is.
How the Log Is Used in Court
Under Federal Rule of Evidence 901, a party offering a physical or digital item must “produce evidence sufficient to support a finding that the item is what the proponent claims it is.” The evidence log is the primary tool for meeting that standard. The Advisory Committee notes specifically point to “testimony establishing narcotics as taken from an accused and accounting for custody through the period until trial, including laboratory analysis” as an example of how authentication works in practice.4Legal Information Institute (LII). Rule 901 Authenticating or Identifying Evidence
Rule 901 also recognizes authentication through “evidence describing a process or system and showing that it produces an accurate result.” That matters especially for digital evidence, where automated logging and forensic tools generate their own records. If the system that captured or stored the evidence can be shown to work reliably, that itself helps authenticate the output.4Legal Information Institute (LII). Rule 901 Authenticating or Identifying Evidence
When a chain of custody challenge is raised, the judge treats it as a conditional relevance question: is there enough evidence for a reasonable juror to conclude the item is genuine? A well-kept log usually clears that bar. A log with gaps or missing signatures often doesn’t.
Logs for Digital Evidence
Digital evidence requires everything a physical log demands, plus a layer of technical documentation unique to electronic data. Because digital files can be copied perfectly and altered invisibly, the log needs to prove the file hasn’t changed since collection.
The primary tool is cryptographic hashing. NIST recommends hashing digital images and files using an approved algorithm and storing the resulting hash values separately from the evidence itself, in a location where they can’t be overwritten by anyone with access to the original files. If the hash calculated at collection matches the hash calculated before trial, the data has not been altered by so much as a single bit.5NIST. Digital Evidence Preservation – NIST IR 8387
NIST guidance is clear that hashing should happen “as close to collection as possible.” Many surveillance and forensic collection systems now hash files automatically before law enforcement takes custody. When a hash isn’t feasible, the alternative is to create a copy of the data early, store it on physical media, and document every subsequent transfer.5NIST. Digital Evidence Preservation – NIST IR 8387
NIST Special Publication 800-86 adds a practical warning: “because electronic logs and other records can be altered or otherwise manipulated, organizations should be prepared, through their policies, guidelines, and procedures, to demonstrate the integrity of such records.” The log that tracks digital evidence must itself be protected against tampering, usually through case management software with access controls and audit trails, or by printing and physically securing hash records.6NIST. NIST SP 800-86 Guide to Integrating Forensic Techniques
Beyond hash values, a digital evidence log typically records the original source of the file, how it was created or transferred, the device or media it came from, and relevant metadata such as creation and modification timestamps. These details let someone verify later that the item in storage is the same one collected at the scene.5NIST. Digital Evidence Preservation – NIST IR 8387
What Happens When the Log Has Gaps
A break in the log doesn’t automatically make evidence disappear from a case, but it creates a vulnerability that skilled attorneys will exploit. The consequences depend on how serious the gap is.
At the authentication stage, the judge decides whether there is enough foundation for a reasonable person to believe the evidence is genuine. A missing signature, an unexplained two-day gap in custody, or a log entry with the wrong date can all undermine that foundation. If the judge finds the chain too unreliable, the evidence stays out entirely.4Legal Information Institute (LII). Rule 901 Authenticating or Identifying Evidence
More often, minor gaps go to the weight of the evidence rather than its admissibility. The judge lets it in, but the defense hammers the broken link during cross-examination. A forensic examiner who can’t explain why a blood sample sat unlogged in a lab refrigerator for a weekend will have a hard time convincing jurors that nothing happened to it. The evidence makes it in; its persuasive power is gutted.
NIJ notes that maintaining the chain is “vital for any type of evidence,” and that when laboratory analysis reveals contamination, “it may be necessary to identify persons who have handled that evidence.” A log with gaps makes that identification impossible, which can undermine not just one piece of evidence but an entire forensic analysis built on top of it.3National Institute of Justice. Chain of Custody of Evidence
Common Mistakes That Break the Log
Most problems aren’t dramatic. They are mundane oversights that compound between collection and trial.
- Delayed logging. An officer collects evidence but doesn’t complete the entry until hours or days later. Collection times and locations get approximated rather than recorded, creating openings for challenge.
- Missing signatures. A custody transfer happens informally, without both parties signing. The log shows the item leaving one person’s hands but doesn’t confirm who received it.
- Vague descriptions. The log describes “one plastic bag containing white powder,” but three items in storage match that description. Without unique tag numbers cross-referenced in the log, identifying the correct item becomes an argument rather than a fact.
- Failing to log returns. Evidence sent to a lab comes back, but no one records its return. The log shows it leaving but not arriving, creating an unaccounted-for period.
- Inconsistent digital records. Hash values are calculated but stored in the same system as the evidence itself, meaning anyone who could alter the evidence could also alter the hash. NIST specifically warns against this.
Each of these is individually fixable with discipline and training. Together they represent the gap between agencies that rarely lose evidence challenges and those that regularly do.
Where Evidence Logs Are Used
Criminal cases get the most attention, but logs serve the same function in any setting where items or documents may later need to prove something in a formal proceeding. Department of Labor enforcement investigators maintain chain-of-custody documentation during audits of employee benefit plans, using the same itemized receipt and return-of-documents process a police detective would recognize. All civil and criminal evidence and related documentation must be saved to a secure internal network with access limited to active enforcement staff.2U.S. Department of Labor. Enforcement Manual – Collection and Preservation of Evidence
Corporate internal investigations, insurance fraud inquiries, and regulatory compliance audits all benefit from the same logging discipline. If a dispute ends up before a court or regulator, the side that can show its evidence has been carefully tracked and stored has a credibility advantage over the side that can’t. The log protects the evidence, and in turn it protects the people relying on it.