Chain of Custody Explained: Why Records Win Cases and Lose Them

You can have an authentic document, recording, device, or physical item and still be unable to rely on it later.

The problem may not be that anyone faked it. The problem may be that nobody can explain what happened to it during the four days it sat on a desk, moved between accounts, or remained accessible to other people.

This article is about custody, not genuineness. How to Verify a Document Before You Trust It asks whether an item is genuine, who issued it and whether its origin can be confirmed. This article asks a different question:

Can you prove who held the item, when it moved, where it went, and whether it could have changed?

Start Preserving Early

Preservation begins when a dispute is reasonably foreseeable, not when a lawsuit is filed or someone finally asks for the evidence.

Stop deleting. Stop re-saving. Stop tidying. Start logging.

Record what you received, when you received it, where it came from, and who handled it. A short, contemporaneous record is usually more useful than a confident reconstruction months later.

What Chain of Custody Means

Chain of custody is the documented, unbroken account of an item’s possession from the moment it was created or collected to the moment it is reviewed, transferred, or presented.

It normally records:

• What the item is.
• When and where it was collected or received.
• Who possessed it.
• How it was transferred.
• Where it was stored.
• What was done to it.
• Whether any change was made.

Chain of custody is not the same as authentication. Authentication concerns whether an item is what its proponent claims it is. Custody provides the practical history used to support that conclusion.

This matters far beyond criminal proceedings. Chain-of-custody problems arise in insurance claims, employment disputes, contract disagreements, internal investigations, family matters, regulatory reviews, and civil litigation.

This is a business and legal reality. It is not merely a courtroom formality.

The Four Questions That Matter

A reliable custody record must answer four questions.

1. Identity

Is this the same item that was collected?

Can you identify it from its label, file structure, serial number, hash, packaging, or other recorded characteristics?

2. Integrity

Is the item in the same condition?

If it changed, can you explain when, why, how, and by whom?

3. Continuity

Is there any period when possession is unaccounted for?

A missing handover, unexplained storage period, or absent transfer record creates uncertainty.

4. Access

During any gap, who could have touched, opened, edited, copied, moved, or deleted the item?

A chain does not become reliable because three links are excellent. It fails at the weakest of the four.

The Rules That Actually Govern

Under Federal Rule of Evidence 901(a), authentication is a condition precedent to admissibility. In general terms, the proponent must provide evidence sufficient to support a finding that the item is what the proponent claims it is. Federal Rule of Evidence 901

Federal Rule of Evidence 1002 generally addresses the original-writing rule: when a party is proving the content of a writing, recording, or photograph, the original is ordinarily required unless an exception applies. Rule 1003 generally permits a duplicate to the same extent as the original unless a genuine question is raised about the original’s authenticity or admitting the duplicate would be unfair. Federal Rules of Evidence 1002 and 1003

A gap in the chain does not automatically make evidence inadmissible. When there is sufficient testimony or other foundation to support a finding of authenticity, an ordinary gap generally goes to the weight the factfinder gives the evidence rather than its admissibility.

But the opposite extreme is also wrong. Exclusion remains possible when a foundational link is missing or the chain is so compromised that the item cannot be shown to be reliable.

The result depends on the facts, the law, and the forum. State rules may differ from the federal rules. A court, arbitrator, insurer, or regulator may apply different procedures. This is general information, not legal advice, and no outcome should be predicted from this article.

What Breaks a Chain in Practice

Most custody failures are ordinary and human. That is precisely why they are dangerous.

Someone passes an item to a colleague without recording the date, reason, or recipient. A scan replaces the original. A file is re-exported, renamed, converted, or re-saved, and nobody records what happened.

A device is wiped. An inbox is cleaned. A folder is reorganized. Surveillance footage, dashcam clips, or cloud backups expire under a fixed retention cycle while everyone assumes the material is safe.

A shared company login, family plan, or drive makes it impossible to say who accessed a record. A laboratory test consumes a sample without a documented protocol or retained portion. A legitimate annotation or conversion occurs, but nobody records who made the change.

Storage can also alter material. Sync tools may reformat a drive. Applications may compress an upload. Platforms may strip metadata.

The record is what separates an ordinary mistake from an unanswerable question.

Why Digital Evidence Is Different

Digital evidence authentication presents additional problems.

Copies can be perfect. A duplicate and an original may look identical while being legally different items with different histories.

The original may not be in your possession. It may remain with a platform, carrier, cloud provider, or other third party that you do not control.

The handler may be an automated system. No person may have manually opened or moved the file. Courts may therefore consider whether a reliable process produced the record, sometimes described generally as a “silent witness” approach.

Metadata can change invisibly. A transfer, upload, re-save, or screenshot may alter or remove metadata while leaving the visible text or image unchanged.

A screenshot is not the underlying record. It is a picture of the record. It typically removes the metadata and system information that might have helped show where the content came from, when it existed, and how it was handled.

Where Authentication Gets Decided

In United States v. Vayner, 769 F.3d 125 (2d Cir. 2014), the Second Circuit addressed a printed social-media profile offered as the defendant’s profile. The court held that the government had not supplied sufficient evidence to establish that the defendant created or controlled the page. The page’s existence was not enough to establish its connection to the defendant. United States v. Vayner

In United States v. Belt, Nos. 24-3265 and 24-3296 (8th Cir. May 15, 2026), the Eighth Circuit considered automatically generated home-security-camera footage containing gaps ranging from seconds to more than 22 minutes. The majority affirmed admission under the circumstances presented, treating the gaps and possible tampering primarily as issues for the factfinder to weigh. A dissent questioned whether the foundation was sufficient because the record did not adequately establish the camera, software, operating process, or reasons for the missing segments. United States v. Belt, official Eighth Circuit opinion

These decisions illustrate the same practical point. Neither issue depended on proving deception. The issue was what could, and could not, be shown about the item.

What to Do Before You Need It

Start the log when the item is received, not when the dispute begins.

Record the date, time, source, transfer method, and people present. Use one consistent transfer form and one custody log for the matter. Record internal handovers, not only transfers to outside parties.

Keep the original where you have it. Work from a copy. Label the copy as a copy.

Do not clean up, tidy, delete, cancel, deactivate, reformat, or reset anything once a matter is live or reasonably foreseeable. The instinct to tidy up is often the single most damaging one.

Photograph or export with context: the full screen, date, account, thread, surrounding messages, and visible source information. Do not capture only the isolated sentence or image.

Where file integrity matters, generate a hash at collection and record it in the log. In plain terms, a hash is a digital fingerprint for a file. A matching hash supports the conclusion that the file has not changed since the hash was taken. It does not prove that the content is accurate, truthful, or complete.

Preserve the device and account. Preserve lawful access information securely so the material remains retrievable. Record who had access during any gap, even when the answer is embarrassing or inconvenient.

A documented imperfection is far better than an undocumented gap.

For Organisations

Organisations need a policy layer, not just individual effort.

Name the person responsible for custody. Use one transfer log. Store items in a way that does not alter them. Set retention and destruction rules that do not conflict with a preservation obligation. Reconcile the IT instinct to optimize storage with the need to preserve original material.

A common failure occurs when the person who knows where everything is leaves, and the record leaves with them.

The Record Is the Product

What you can prove about an item’s history is often worth more than the item itself.

The central question is not simply whether a file, document, photograph, recording, or physical sample appears genuine. The question is whether you can explain its identity, integrity, continuity, and access from collection through presentation.

That is what makes evidence more defensible. That is what clarifies what holds up in court, without predicting what any particular court will decide.

Frequently Asked Questions

What is chain of custody in plain terms?

It is the written history of an item: who had it, when they had it, where it went, how it was stored, and what happened to it.

Does a gap in the chain always make evidence inadmissible?

No. A gap generally affects the weight of evidence when there is still enough foundation to support a finding that the item is authentic. Exclusion remains possible when a foundational link is missing or the chain is so compromised that reliability cannot be established. Courts decide admissibility under the facts and law of the particular matter.

Is a screenshot good enough?

A screenshot may preserve what was visible on a screen, but it is not the underlying record. It may omit metadata, account information, surrounding content, timestamps, system information, and the original file. Preserve the native record and related context whenever possible.

Do I need a hash, and what is one in plain terms?

A hash is a fingerprint calculated from a file. If the file changes, the hash normally changes. A matching hash helps show that the file has not changed since the hash was taken. It does not prove that the content is true or accurate.

What should I do first if I realise something may matter later?

Stop, preserve, log, and do not clean anything up. Record what you have, when you received it, where it came from, and who handled it. Then consult your attorney about the legal preservation requirements that apply to your situation.

About Alaska Investigations Group

Alaska Investigations Group provides confidential investigative documentation, digital intelligence, evidence preservation assistance, research, and litigation support. The firm has more than 10 years of professional investigative experience and handles assignments individually, with attention to documentation, lawful procedures, confidentiality, and professional review.

Licensed Private Investigations Agency in Anchorage, Alaska. License 1126. Serving statewide except Fairbanks.

General Information Disclaimer

This article is provided for general informational purposes only. It is not legal advice, legal representation, forensic advice, or a guarantee that any item will be authenticated, admitted, excluded, or given a particular weight.

The rules of evidence, authentication, admissibility, retention, preservation, privacy, and data access vary by jurisdiction and by forum, including courts, arbitration proceedings, insurers, and regulators. Courts decide admissibility on the facts and law of the case before them. Readers should consult their own attorney and, where relevant, their insurer, regulator, or counsel before relying on information in this article.

Alaska Investigations Group is not a law firm and does not provide legal advice. Alaska Investigations Group is not law enforcement. The firm cannot compel records or subpoena documents. No outcome is promised or guaranteed.

Sources

• Federal Rules of Evidence, U.S. Courts: Rules 901, 1002, and 1003
• United States v. Vayner, 769 F.3d 125, Second Circuit, 2014
• United States v. Belt, Nos. 24-3265 and 24-3296, Eighth Circuit, May 15, 2026
• How to Verify a Document Before You Trust It

Request a Confidential Consultation

For businesses, attorneys, and organisations that need evidence documented, preserved, or reviewed, request a confidential, no-obligation consultation.

Phone: (907) 232-4731
Email: mrrems@protonmail.com