Dating evidence

Chain of custody explained

Last checked 6 November 2026 · 3 sources

Short answer

A chain of custody is the record of who held a piece of evidence, when, and what was done to it. NIST describes it as keeping a log of every person who had physical custody of the evidence, with every action recorded along with who performed it, where and at what time ¹. For digital evidence, NIST advises computing a message digest of the original and the copy and comparing them ¹. The record lets a reader check that the item dated in a chronology is the item that was collected.

Main guidance read: NIST SP 800-86, August 2006 ¹
Core record: Log of every person who had physical custody ¹
Each entry: Action, who performed it, where and at what time ¹
Integrity check: Message digest of original and copy, compared ¹
Time proof for a file: RFC 3161 time-stamp token over a hash ²
Log retention example: India, rolling 180 days, CERT-In 2022 ³

What the record contains

NIST Special Publication 800-86 says the chain of custody involves keeping a log of every person who had physical custody of the evidence ¹. It says to record every action that was taken along with who performed the action, where it was performed and at what time ¹.

NIST says evidence should be stored in a secure location when not in use ¹. It says organisational guidelines should cover maintaining the chain of custody and storing evidence securely ¹.

Who had custody ¹
What action was taken ¹
Where it was taken ¹
When it was taken ¹

Hashes and copies

NIST describes verification as using tools to compute the message digest of the original and copied data and comparing the digests ¹. It says this matters most where data may be needed for legal reasons ¹.

A hash can link custody to time. Under RFC 3161, a Time Stamping Authority time-stamps a hash of a datum, not the datum itself, to establish evidence that the datum existed before a particular time ². A matching hash later shows the same data was held at that time ².

Why custody affects dates

Handling can change the dates a chronology relies on. NIST says that when a file is copied to a system, its creation time becomes the time it was copied ¹. Some logical backup tools may alter file creation times. NIST recommends bit stream imaging where file times are needed. Bit-for-bit copies preserve them ¹.

If an analyst needs to establish an accurate timeline of events, NIST says the file times should be preserved ¹. A custody log that records when a copy was made helps explain any creation time that matches the copy date rather than the original event ¹.

Logs and retention rules

Some rules set how long the records that feed a chronology must be kept. India's CERT-In directions of 28 April 2022 require entities to enable logs of all ICT systems and keep them securely for a rolling period of 180 days within Indian jurisdiction ³.

The same directions require system clocks to be synchronised with the NTP servers of the National Informatics Centre or the National Physical Laboratory, or servers traceable to them ³. Synchronised clocks make entries from different systems easier to place in one order ^1,3.

Steps in a custody record

Step	What is recorded	Source
Collection	Who collected the item, where and when ¹	NIST SP 800-86 ¹
Imaging or copying	Method used, with bit stream imaging where file times matter ¹	NIST SP 800-86 ¹
Verification	Message digest of original and copy, compared ¹	NIST SP 800-86 ¹
Time proof	Optional time-stamp token over the hash ²	RFC 3161 ²
Storage	Secure location when not in use ¹	NIST SP 800-86 ¹
Each transfer	Every person who had custody ¹	NIST SP 800-86 ¹

Common questions

What is a chain of custody?

NIST describes it as keeping a log of every person who had physical custody of the evidence, with each action recorded by who, where and when ¹.

How do you prove a digital copy matches the original?

NIST says to compute the message digest of the original and the copy and compare them ¹.

Can copying evidence change its dates?

Yes. NIST says copying a file to a system sets its creation time to the time of copying ¹.

What does a time-stamp token add?

Under RFC 3161 it is evidence that the hashed data existed before the time in the token ².

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@sequenceofrecord.com.

Sources

Electronic timestamps explained
What file times, log times and trusted time-stamp tokens record, why they can be wrong, and what NIST, IETF and CERT-In guidance says about them.
Date precision and uncertainty
How the Extended Date/Time Format and RFC 3339 record approximate, uncertain, partial and open-ended dates, with examples from the specifications.
How to put events in order
A step-by-step method for building a chronology from dated evidence, drawn from court guidance, forensic standards and legislation records.
Agreed chronologies in litigation
How courts in England and Wales, New Zealand, Qatar and Australia ask parties to prepare an agreed chronology, and how disputed dates are shown.