What Is the Chain of Custody?

During investigations, a variety of sources of evidence are often collected. Chain of custody is the term used when handling evidence, sometimes referred to as exhibits. A clear record of who has handled, accessed, edited, or altered evidence is essential to show that it has not been tampered with and to protect its reliability.

During investigations, it is common that a variety of sources of evidence are collected. Chain of custody is a term that is used when handling evidence, sometimes referred to as exhibits. Evidence can be in the form of a physical object or, as seen more nowadays, digital evidence. A record of who has handled the evidence, who has accessed, edited, or altered it is imperative to ensure that it has not been tampered with in any way that could have a prejudicial effect on an investigation.

Chain of custody is also known within the law enforcement sector as evidence continuity and is seen as a vital part of an investigation. Various courts within the Australian legal system place immense value on the accurate recording of exhibit movement to ensure that matters heard before the court are dealt with in a fair and equitable manner. The New South Wales Police improved their system of recording evidence after the 1998 Wood Royal Commission enquiry exposed evidence tampering by police.

Investigators should always follow the best practice guidelines as outlined below when handling evidence, recording evidence, and tracking the movement of evidence.

Key takeaways

The importance of accurate recording of evidence

Evidence and exhibits play a major role in investigations and it is essential that accurate recording of the evidence is done. Evidence that is relied upon in an investigation and/or presented to a court, tribunal or other proceedings can impact the outcome of a matter. Therefore, accuracy and integrity of the evidence is essential.

Properly documenting the details of evidence can ensure that the original piece of evidence is not altered or tampered with, and that this has been properly documented. Altering or tampering with evidence can occur either with intent to influence a specific outcome or without. However, regardless of the intent, the fact remains that any changes to an original piece of evidence may impact not only the integrity of the piece of evidence but also the integrity of the investigation upon which that evidence is based.

Consequently, an improper chain of custody of evidence can lead to several negative outcomes, including the evidence being deemed inadmissible or unreliable and the matter not being able to be proved to the standard required before the court or other proceedings for which the evidence is being relied upon. Furthermore, casting any doubt over the authenticity and reliability of one piece of evidence can potentially have a flow-on effect on other pieces of evidence in a matter.

Establishing and saving a chain of evidence document

To establish a complete and reliable chain of custody, it is imperative that the following is accurately documented:

A document showing the chain of custody is required for each piece of evidence, regardless of whether it is in a physical or digital form.

In order to preserve evidence, the chain of custody document should commence from the first time evidence is obtained or handled, through to the process of examination, analysis, reporting and the time of presentation. It is essential to avoid the possibility of any suggestion that the evidence has been compromised or mishandled in any way.

A chain of custody document should be contained in a version-controlled digital document, or it could be held in a shared drive. The document needs to be clearly labelled and records kept of when the evidence was accessed. This digital document must have the ability to export a full forensic audit if necessary and/or required.

The key stages of recording evidence in a chain of custody document are:

1. Data Collection: This is where the chain of custody process is initiated. It involves identification, labelling, recording, and the acquisition of data from all the possible relevant sources that preserve the integrity of the data and evidence collected.

2. Examination: During this process, the chain of custody information is documented outlining the forensic process undertaken. It is important to capture screenshots throughout the process to show the tasks that are completed, and any further evidence identified.

3. Analysis: This stage is the result of the examination stage. In the analysis stage, legally justifiable methods and techniques are used to derive useful information to address questions posed in the particular case.

4. Reporting: This is the documentation phase of the examination and analysis stage. Reporting includes the following:

An accurate and complete chain of custody is a vital part of every investigation

The importance of the chain of custody for evidence and accurate record-keeping when handling evidence is a key aspect of investigations and information gathering.

All investigators, whether in law enforcement or other investigations, including corporate investigations, should be equipped and familiar with the knowledge and process relating to the chain of custody of evidence. This will ensure accurate and reliable evidence is able to be presented. Subsequently, the outcome or decision made for the matter can be done with all evidence being considered equally.

FAQ

What is chain of custody?

Chain of custody is the record of who has handled evidence, when it was handled, and where it has been stored or moved during an investigation.

Why does chain of custody matter?

It matters because evidence needs to be accurate, reliable, and protected from tampering if it is to be relied upon in a court, tribunal, or other proceeding.

What should a chain of custody document include?

It should include the item, who collected it, when it was collected, by whom or where it was collected from, and where it is being stored.