Chain of Custody
Chain of Custody
Beweismittelkette
The chain of custody is the seamless documentation of who handled a digital piece of evidence, when, where and how — from acquisition to analysis. It proves that the evidence was not altered unnoticed and thereby decides its admissibility. Without it, even the best forensic find is vulnerable to challenge in court.
History & facts. The principle stems from classic criminal investigation and transfers to digital evidence with particular sharpness: since data can be altered unnoticed, every step — seizure, transport, storage, access — must be logged and secured by hash values. A hash formed at the time of acquisition later proves that a disk image is unchanged. Gaps in this chain mean that authenticity can be disputed.
Outlook & recommendation. With the Network and Information Security Directive 2 (NIS2) duties to document incidents, robust evidence preservation gains importance beyond the pure criminal process. In practice this means: document before the first access, use write protection, form and record hashes, make access traceable. This discipline — clean evidence preservation instead of premature „tidying up“ — is a hallmark of professional Digital Forensics and Incident Response (DFIR) work as performed by NEOSEC.