Chain of custody

The chain of custody proves that a digital exhibit has remained unchanged since preservation and that every handling step can be traced. It breaks as soon as one step is missing – for example when an administrator "just had a quick look" before anything was preserved. The European Union Agency for Law Enforcement Cooperation (incl. EC3) (Europol) report names the still largely manual keeping of this chain as a major source of error, especially where evidence moves across cloud providers, service partners and borders. For companies this means: whoever preserves evidence in-house needs a custody form, hash values and named owners – or someone who does this routinely.