What chain of custody records
A continuity record should identify the exhibit, the person releasing it, the person receiving it, the date and time, the purpose of transfer, the condition of seals or packaging, and the storage location. Each movement should be documented as it occurs.
Why digital evidence needs special care
Digital evidence can be altered by normal device use, automatic synchronisation, software updates and remote access. Preservation therefore includes both physical control of the exhibit and technical steps to reduce unintended change.
The role of hash values
A cryptographic hash is a calculated value derived from digital data. Matching hash values can demonstrate that a forensic image or file remained unchanged between documented stages. Hashes support integrity, but they do not replace proper exhibit identification and custody records.
Common continuity weaknesses
Problems arise when devices are not individually identified, transfers are reconstructed later, packaging is not documented, original files are repeatedly opened, or working copies are not distinguished from preserved evidence.
Practical instruction
Keep an exhibit log from the moment of receipt. Record every transfer, preserve original media, use verified copies for examination, and ensure the report refers to the same exhibit identifiers used in the custody documentation.