Chain of Custody: The Basics

A Chain of Custody (CoC) is a legal document that represents one client original media; a phone, a computer, a hard drive, etc.

The CoC shows who has been in possession or custody of the electronic storage device absence its possession with the custodian, the original owner of the device. In other words, if you own that phone that device is yours. You should always be in possession of that phone, as soon as you release that phone to us we are in custody. It then becomes our responsibility to track the movement of the phone and who has been in contact with it until the moment it is returned back to the original custodian.

Each device should have it’s own unique CoC. Sometimes you will be asked to retrieve multiple devices, in which case you would have several CoC’s, one for each client media. The reason we have a single CoC per device is that it allows us to track the movement of the media. Also if we have multiple devices that need to get returned at different times and places we can easily track and manage this now.

A CoC is considered a legal document and can be used in a court of law. It is important that when tracking you record and write clearly. In short, a Chain of Custody covers and records the sequence of custody, control, transfer and delivery of a physical or electronic evidence.