Chain of custody

A record of every hand an item of evidence passes through, from collection and storage to analysis: who took or transferred it, when, and for what purpose. If an incident could lead to litigation, an insurance claim or a regulator's investigation, start the record with the first disk image or log export; gaps make the evidence easy to challenge.

Further reading: csrc.nist.gov

All terms