Page 1
CHAIN OF CUSTODY · A GUIDE FOR UK LAWYERS Digital Chain of Custody: A Practical Guide for Lawyers Continuity, Transfer Records and the Documentation That Survives Court COMPUTER FORENSICS LAB E-DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES FULL CHAIN-OF-CUSTODY DOCUMENTATION CPR PART 35 EXPERT REPORT S COURT-EXPERIENCED EXPERT WITNESSES
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the question every exhibit must answer 03 The two strands: physical and logical custody 04 The custody lifecycle, stage by stage 05 Sample records: the forms that do the work 06 Weak versus defensible: the same events, two files 07 What breaks a chain, and what a break actually costs 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: CONTINUITYISPROVEN, NEVERPRESUMED
§ 02 · FIRST PRINCIPLES The problem in plain English: the question every exhibit must answer
§ 03 · THETWOSTRANDS The two strands: physical and logical custody
Page 2
§ 04 · THELIFECYCLE The custody lifecycle, stage by stage STAGE CUSTODY ACTION S
§ 05 · THE PAPER WORK Sample records: the forms that do the work Exhibit record (opened at acquisition, one per exhibit) Transfer record (one row per movement, appended to the exhibit record) FIELD ENTRY (ILLUSTRATIVE) DATE / FROM TIME (SIGNED) TO (SIGNED) PURPOSE SEAL / HASH CHECK 14 Mar [Examiner] Evidence store Storage post- Seal [n] intact; image SHA-256 verified 02 Apr Evidence [Examiner] Examination per Seal [n] intact; opened; working copy 02 Apr [Examiner] Evidence store Return post- Resealed [new seal n]; master untouched, 14 May Evidence [Courier, Delivery to [solicitors] Sealed [n]; copy drive SHA-256 [value] 14 May [Courier] [Recipient, Receipt Seal [n] confirmed intact; drive hash re-
§ 06 · SIDEBYSIDE Weak versus defensible: the same events, two files WEAK DOCUMENTATION SAYS DEFENSIBLE DOCUMENTATION SAYS
§ 07 · BREAKS What breaks a chain, and what a break actually costs
§ 08 · IN THE WILD Worked examples EXAMPLE1 · THECABINETMONTHS EXAMPLE2 · THEGAPTHATWASBOUNDEDANDSURVIVED EXAMPLE3 · THESCHEDULEOFTHEIRGAPS
§ 09 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
Page 3
§ 10 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · CLIENTINSTRUCTIONES TA BLISHINGCUSTO DY FROM DAY ONE SUGGESTED WORDING · REQUESTFORANOPPONENT ' SCUSTO DY RECORDS
§ 11 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The chain-of-custody checklist Red flags When to involve a digital forensic expert
§ 12 · COMMON QUESTIONS Frequently asked questions Does a broken chain make the evidence inadmissible? We already have material that was handled casually before anyone thought about custody. Is it ruined? Who should hold evidence during litigation: the client, the solicitors or the laboratory? How does chain of custody work for cloud data, where there is no device to seal? Do we really need tamper-evident seals and forms for a modest commercial dispute? What should the chain say when evidence is finally returned or destroyed?
§ 13 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Digital Chain Of Custody A Practical Guide For Lawyers, Computer Forensics Lab, https://e-discovery.uk/library/digital-chain-of-custody-a-practical-guide-for-lawyers/pdf.