Chain of custody
- Term
- Chain of custody
- Exam
- CISA & CISM
- Definition
Documentation of who handled evidence, when and how, from collection onward.
- Explained
Chain of custody records who collected, handled and stored evidence, when and how. Without it, evidence can be challenged and may be inadmissible.
- In practice
A form records each person who handled a seized laptop, with dates and signatures.
- Often confused with
- Evidence integrity hash
- Exam angle
Required for evidence to be admissible.
- Related