Glossary
Chain of custody
Also called: custody trail
Chain of custody is the documented, unbroken record of who has held, accessed or altered an item of evidence, and when. For electronic documents it is established by an audit trail rather than by physical signatures, and its value depends on that trail being unalterable.
Chain of custody explained
What it establishes
That a document produced as evidence is the document that was created, unaltered, and that every access to it in between is accounted for. A break in the chain does not prove tampering; it removes the ability to disprove it, which in practice is enough to weaken the evidence.
Electronic chain of custody
For paper, custody is established by signatures on a form. For electronic documents it is established by the audit trail, and the requirements follow from that: the trail must record who accessed the document as well as who changed it, must be append-only, and must be beyond the reach of anyone with an interest in the outcome — including administrators.
Content hashing strengthens the position further, since a hash recorded at capture and verified at production demonstrates the bytes are unchanged.
When it matters
Investigations, disciplinary proceedings, litigation, regulatory enforcement, and any case where a document is likely to be challenged. It is worth deciding in advance which record classes might end up in that position, because retrofitting custody evidence is not possible — the trail either exists from the start or it does not.
What breaks a chain
Copying a document out of the controlled system and back in, editing it in a tool that does not record who did so, or a period during which access was not logged. Each introduces a gap that cannot be filled retrospectively, which is why the discipline is about keeping records in the system rather than about reconstructing history afterwards.
FAQ
Chain of custody: common questions
Does chain of custody require special software?
Not special, but it does require an audit trail that records reads, cannot be edited by administrators, and outlives the document. Many systems satisfy the first and fail one of the other two.
How long should custody evidence be kept?
At least as long as the record it concerns, and usually longer — questions about a document's handling often arise after the document itself has been disposed of.
Related terms
- Audit trailAn audit trail is an append-only record of every action taken on a document — views, downloads, edits, approvals, permission changes and deletions — with the acting user, timestamp and affected version.
- DispositionDisposition is what happens to a record when its retention period expires: destruction, transfer to an archive, or a decision to extend.
- Document controlDocument control is the discipline of ensuring only approved documents are in use, superseded ones cannot be mistaken for current, and every change is authorised and recorded.
- Information governanceInformation governance is the framework of accountability, policies and controls determining how an organisation creates, uses, retains and disposes of its information.
- Legal holdA legal hold suspends the routine destruction of records that may be relevant to litigation, an investigation or an audit.
- Records managementRecords management governs how long a document is kept and what happens at the end of that period.
Última revisión: 28 de agosto de 2026. Browse the full glossary.