Chain of custody is the documented trail that tracks every person who handled a piece of evidence, from the moment it was collected through its presentation in court. The purpose is proof: before a judge lets a bag of narcotics, a blood sample, or a forensic image of a hard drive reach the jury, the party offering it has to show the item is genuine and has not been altered. That showing is made through the log entries, signatures, seals, and verification steps that make up the chain. A single missing signature or broken seal can shift a case’s outcome, which is why the rules governing how evidence is handled are detailed enough to repay close attention.
The Legal Standard Behind the Chain
Every chain of custody requirement traces back to one rule. Under Federal Rule of Evidence 901(a), the party offering an item must produce evidence sufficient to support a finding that the item is what they claim it is.1Office of the Law Revision Counsel. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence The rule does not prescribe a specific chain of custody procedure. It sets a threshold: no authentication, no admission.
Rule 901(b) lists ways to clear that threshold. The most common in custody disputes is testimony from a witness with knowledge, meaning someone who can say under oath that the item is what it appears to be.1Office of the Law Revision Counsel. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence In a drug case, that might be the officer who seized the substance, the technician who tested it, and every custodian in between, each describing what they did with the item and when. For digital material, Rule 901(b)(9) allows authentication through evidence describing a process or system and showing that it produces an accurate result, which is how forensic imaging gets into court.
The burden sits on the party offering the evidence, but courts have been clear that the burden is not heavy. The proponent must show reasonable precautions were taken to preserve the evidence in its original condition, not that every conceivable possibility of tampering has been eliminated.2United States Courts for the Third Circuit. Final Instructions – Consideration of Particular Kinds of Evidence A perfect chain is ideal, but minor gaps rarely keep evidence out on their own.
The judge’s gatekeeping role is governed by Rule 104(b). When authenticity depends on whether the chain was maintained, the judge decides whether enough foundation exists to support a reasonable finding that the item is genuine.3Legal Information Institute. Federal Rules of Evidence Rule 104 – Preliminary Questions If the foundation clears that bar, the evidence comes in. Any remaining questions about gaps or handling errors go to the jury as issues of weight, not admissibility. That distinction is where most chain of custody battles are actually fought.
What the Chain of Custody Log Must Record
The log is the spine of the whole process. Every piece of evidence gets a unique identification number, a description specific enough to distinguish it from anything else in the room, and a record of when and where it was collected.4National Center for Biotechnology Information. StatPearls – Chain of Custody Specific means color, dimensions, serial numbers, visible damage, and anything else that would let someone identify the exact item months or years later. A description like “one black phone” will not hold up when the defense points out that the evidence room contains dozens of black phones.
Every transfer gets its own entry. The person releasing the item signs out, the person receiving it signs in, and both record the date and time. The reason for the transfer, whether moving the item to a lab for testing, transporting it to court, or returning it to storage, goes in the log as well.4National Center for Biotechnology Information. StatPearls – Chain of Custody The goal is zero unexplained gaps. If an item sat in a locked evidence room from Tuesday to Friday, the log should show who locked it up, who unlocked it, and that nobody accessed it in between. Standard chain of custody forms, such as the sample form published by NIST, include structured fields for each data point so nothing gets skipped.5National Institute of Standards and Technology. Sample Chain of Custody Form
Accuracy is not optional. A date written as “3/4” when the seizure was on March 5 creates an inconsistency defense counsel will exploit. A missing signature raises the question of who had possession during that window. These errors do not always result in exclusion, but they hand the opposing side a tool to chip away at the evidence’s credibility.
Physical Handling and Storage
Once evidence is logged, physical security measures take over. Items go into tamper-evident bags or rigid containers sealed with specialized adhesive tape. The person sealing the container signs or initials across the seal itself, so that any attempt to open the package would visibly break the marking. A broken seal is obvious and immediately documented.
Storage requirements depend on the item. Standard evidence goes into locked evidence rooms or reinforced lockers with restricted access. Biological evidence, including blood samples, DNA swabs, and tissue, requires climate-controlled storage to prevent degradation. A blood sample left at room temperature for days may be useless for testing, and the log will show exactly when proper storage stopped, giving the defense a concrete basis for challenging the results. Access to storage areas is tracked through electronic entry logs or physical sign-in sheets, adding another layer of documentation.
Every time evidence changes hands, the receiving party must inspect the tamper-evident seal before accepting the item. Tears, peeling, scratches, or any sign that the seal was disturbed triggers a halt in the transfer and a notation in the record. Skipping that inspection, even when the seal looks fine, means the receiving custodian cannot later testify with certainty that the evidence arrived intact. That testimony gap becomes a weak link the opposing side will target.
Digital Evidence
Digital evidence creates problems that physical evidence does not. A file can be copied, altered, or deleted without leaving any visible trace, so the chain of custody for electronic data relies on mathematical verification rather than physical seals.
Forensic Hashing
The core tool is a hash function, an algorithm that takes a file or an entire drive and generates a fixed-length string of characters unique to that data. Change a single bit, and the hash value changes completely.6National Institute of Standards and Technology. Guide to Integrating Forensic Techniques into Incident Response By recording the hash immediately after seizing digital evidence, investigators create a mathematical baseline. Any later copy can be hashed and compared; if the values match, the copy is identical to the original.
Algorithm choice matters. MD5 and SHA-1 have both been shown to be vulnerable to collision attacks, meaning two different files can produce the same hash, which defeats the entire purpose. NIST now recommends the SHA-2 family, with SHA-256 as the minimum for interoperability, and has approved the SHA-3 family as well. SHA-1 is scheduled to be removed from NIST’s list of approved algorithms after December 31, 2030.7National Institute of Standards and Technology. NIST Policy on Hash Functions Forensic practitioners still encounter MD5 hashes on older case files, but any new forensic work should use SHA-256 at a minimum.
Write-Blockers and Forensic Imaging
Before copying data from a seized device, forensic examiners use a write-blocker, a hardware or software tool that prevents any data from being written back to the source drive during imaging.6National Institute of Standards and Technology. Guide to Integrating Forensic Techniques into Incident Response Without one, connecting a drive to a computer can automatically alter timestamps and metadata, compromising the evidence before anyone looks at it. Write-blockers are a recognized best practice rather than a requirement written into a specific statute, but failing to use one invites a challenge most courts will take seriously. The log for digital evidence should document the write-blocker model, the imaging software and version, and the hash values generated before and after the process.
Self-Authentication of Digital Copies
A 2017 amendment to the Federal Rules of Evidence created a streamlined path for authenticating digital copies. Rule 902(14) allows data copied from an electronic device or file to be self-authenticated, with no live witness needed to testify about the copying process, if a qualified person certifies that the hash values of the original and copy match.8Legal Information Institute. Federal Rules of Evidence Rule 902 – Evidence That Is Self-Authenticating The committee notes explain the logic: if the hash values are identical, it is highly improbable that the original and copy differ. The underlying chain of custody for the original device still needs to be established through traditional means.
Where Chain of Custody Rules Reach Beyond Criminal Cases
Chain of custody is often thought of as a criminal-law concept, but the same documentation discipline shows up elsewhere, and the consequences for failure can be just as severe.
In civil litigation, once a party reasonably anticipates a lawsuit, it has a duty to preserve relevant evidence. In practice, that means issuing a litigation hold, a written directive to employees and IT departments to stop routine deletion of documents and electronic files that could be relevant. When electronically stored information that should have been preserved is lost because a party failed to take reasonable steps to keep it, Federal Rule of Civil Procedure 37(e) gives the court two tiers of response. If the loss prejudices the other side, the court can order measures necessary to cure the prejudice. The heavier sanctions, including a presumption that the lost information was unfavorable, an adverse-inference jury instruction, dismissal, or default judgment, kick in only when the court finds the party acted with the intent to deprive the other side of the information.9Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
Federal workplace drug testing runs on its own tightly regulated chain. Every specimen collected under Department of Transportation or other federal agency programs is tracked on a Federal Custody and Control Form that follows the sample from collection to laboratory to the Medical Review Officer who verifies the result.10Substance Abuse and Mental Health Services Administration. Federal Drug Testing Custody and Control Form If the identification numbers on the bottle seals do not match the form, or if a seal is broken with no intact backup specimen available, the test is canceled entirely.11eCFR. 10 CFR 26.129 – Assuring Specimen Security, Chain of Custody, and Preservation The system is built on the principle that a broken chain makes the result unreliable regardless of what the lab found.
When the Chain Breaks
The legal consequences of a broken chain depend on how bad the break is and whether it suggests actual tampering or just sloppy procedure. Courts draw a line between problems that affect admissibility and those that affect weight.
Gaps That Go to the Jury
Most defects fall on the weight side. Federal courts have held repeatedly that a defect in the chain goes to the weight of the evidence, not its admissibility, as long as the proponent showed reasonable precautions were taken.2United States Courts for the Third Circuit. Final Instructions – Consideration of Particular Kinds of Evidence A missing signature on one transfer, a log entry with an ambiguous time, a temporary storage location that was not ideal: these get aired in front of the jury, and defense counsel argues the evidence should not be trusted. The judge may instruct the jury to consider the gap in deciding how much weight to give the item. The evidence stays in, but its persuasive force takes a hit.
Exclusion
Exclusion is reserved for situations where the chain is so thoroughly broken that no reasonable jury could find the evidence authentic. A complete absence of documentation for a critical period, clear evidence of tampering such as a visibly resealed container or conflicting lab results, or a custodian who cannot be identified or located: these are the kinds of failures that lead judges to keep evidence out entirely. The opposing party raises the issue through a pretrial motion, and the judge evaluates whether the authentication threshold under Rule 901 has been met.1Office of the Law Revision Counsel. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence When evidence is excluded, the offering party loses not just that item but everything derived from it: test results, expert opinions based on the sample, and any conclusions that depended on the excluded material.
The practical takeaway is the same across contexts. Chain of custody exists to protect the integrity of evidence, and the system takes failures seriously, whether the remedy is a jury instruction, exclusion of a key exhibit, or sanctions that reshape the entire case.