Chain of Custody for Digital Evidence: What Survives a Challenge

What chain of custody has to prove for digital evidence

Chain of custody for digital evidence is the documented record showing that a file or forensic image offered in court is the same data collected from the source, unaltered in between. Federal Rule of Evidence 901(a) requires only evidence "sufficient to support a finding that the item is what the proponent claims it is." In federal practice, gaps usually go to weight rather than admissibility — but a foundation no witness can explain still gets evidence excluded.

The standard is lower than most litigators assume, and that cuts both ways

Rule 901(a) sets a production burden, not a persuasion burden — "evidence sufficient to support a finding," the same formulation Rule 104(b) uses for facts on which relevance depends. Nothing requires a perfect custody record.

Courts apply it leniently. In United States v. Dewitt, 943 F.3d 1092 (7th Cir. 2019), an FBI agent powered off a seized cell phone and left it on his desk in an unlocked office overnight before logging it into evidence. The Seventh Circuit held the chain "does not need to be perfect"; the government need only show "reasonable precautions," a standard that "does not require excluding all possibilities of tampering." Because the phone stayed inside an FBI office accessible only to five or six employees with a personal ID card and access code, the presumption that property in police custody has not been tampered with — a presumption that applies "[a]bsent any evidence to the contrary" — carried the day, and the gap went to weight.

That is the good news for proponents and the trap for opponents: a motion styled as "someone could have altered this," unsupported by evidence, almost never wins. The challenges that succeed attack something else — whether the sponsoring witness can describe the process that produced the exhibit.

In American Express Travel Related Services Co. v. Vinhnee (In re Vinhnee), 336 B.R. 437 (B.A.P. 9th Cir. 2005), the trial court refused to admit a card issuer's computerized records because the records custodian knew almost nothing about the systems that produced them — testimony the panel described as "vague, conclusory, and ... unpersuasive." The court allowed a post-trial submission to cure the defect and still found it inadequate. The Bankruptcy Appellate Panel affirmed, holding that a court may insist every element of the foundation be correctly established even absent an objection. That holding is sharper than it first looks: the debtor had defaulted and did not appear at trial, so there was no adversary in the room. Judgment went to the defendant anyway, and the trial court noted that the creditor would have prevailed on one of its two counts had the records come in. Vinhnee is a bankruptcy appellate panel decision — persuasive rather than binding — but it is cited far outside bankruptcy for the proposition.

Vinhnee also supplies the most useful framing available. For a stored record, the authenticity question "is not on the circumstances of the creation of the record, but rather on the circumstances of the preservation of the record during the time it is in the file" — chain of custody, restated as an evidentiary rule.

Three hashes, not one

Acquisition logs often record a single hash. NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response (2006), recommends three, and the third is the one that matters in a deposition:

1. Compute and record the message digest of the original media before imaging.
2. After imaging, compute the digest of the copy and compare it against the original.
3. Recompute the digest of the original media to verify that the imaging process did not alter it.

Step three is the empirical proof that the acquisition was non-destructive. Without it, matching hashes show only that the copy matches whatever the source looked like after the examiner touched it. NIST adds that all results should be documented, and that the digests should be stored on read-only or write-once media, or printed, and then secured.

SP 800-86 is guidance written in "should" language, not a legal standard and not binding on anyone. Its practical weight is as a published, neutral benchmark against which a court or an opposing expert can measure whether a collection was reasonable.

Know what a hash does and does not establish. It proves two data sets are bit-for-bit identical — the 2017 Advisory Committee Note to Rule 902(14) puts it as identical hash values "reliably attest to the fact that they are exact duplicates." It proves nothing about whether the correct source was collected, whether the collection was complete in scope, or whether the data was altered before the examiner arrived. Conflating those questions wastes a cross-examination.

On algorithms, be careful with the vintage of the guidance. SP 800-86 told federal agencies in 2006 to prefer SHA-1 over MD5 because SHA-1 was FIPS-approved and MD5 was not, and its footnote flagged that agencies should plan to transition to stronger variants such as SHA-224 or SHA-256 by 2010. That advice has since moved: NIST retired SHA-1 in December 2022, recommends migrating to SHA-2 or SHA-3, and has set a full phase-out deadline of December 31, 2030. A collection logged today only in MD5 is not automatically inadmissible, but it is worth asking about, and the answer belongs in the report rather than the examiner's memory. Our guide to reading a forensic report covers what else that document should contain.

Write blockers, and the collections that do not have one

A write blocker sits between the evidence drive and the examiner's workstation. NIST is blunt about the function: "Using a write-blocker during backups and imaging prevents a computer from writing to its storage media." NIST's Computer Forensics Tool Testing program maintains separate Hardware Write Block and Software Write Block categories and publishes the specifications and test plans — the hardware specification is at Version 2.0 — while the Department of Homeland Security publishes the resulting test reports for individual devices. That makes "we used a write blocker" an answerable question rather than an article of faith. Ask which device, which firmware, and whether that model has a published report.

The harder problem is that a growing share of collections have no drive to block. Microsoft 365 and Google Workspace exports, Slack exports, and cloud storage pulls run through vendor APIs, with no physical interface to interpose on. Mobile extractions present a different version of the same gap: the examiner connects to the handset directly, but acquisition generally requires interacting with — and often writing to — the device, so blocking writes is not an option either. In both settings the write blocker's role falls to Rule 901(b)(9) — "[e]vidence describing a process or system and showing that it produces an accurate result," which the Advisory Committee note says was "designed for situations in which the accuracy of a result is dependent upon a process or system which produces it."

Operationally, that means preserving the export or extraction job's own audit record. The tenant-side log showing who ran the export, under what credentials, over what date range and custodian set, with what result count, is the artifact that substitutes for the hardware. Capture the tool name and version with it. If nobody preserved that log at the time, it usually cannot be reconstructed.

Incident-response collections are the worst offenders: responders are trying to stop an intrusion, and reimaging machines is legitimate remediation. If evidence is likely to matter, someone has to say so before containment starts — a tension running through ransomware response obligations generally.

What actually belongs in the custody log

NIST's guidance is concrete: keep a log of every person who had physical custody, document the actions they performed and at what time, store the evidence in a secure location when it is not being used, perform examination and analysis using only the copy, and verify the integrity of both the original and the copy.

The documentation NIST calls for around the image itself is what practitioners most often omit:

• the hard drive model and serial number
• the media storage capacity
• the imaging software or hardware used, by name and version number, with licensing information
• every step taken to create the image, in enough detail that another examiner could produce an exact duplicate using the same procedures

The serial number is the load-bearing item. It ties the image on a review platform to the specific device seized. Without it, the opponent's argument is not "you tampered with this" — it is "you cannot tell me this image came from that laptop," a far harder question to answer eighteen months later.

Rules 902(13) and 902(14) move the fight onto the pretrial calendar

The 2017 amendments added two self-authentication routes, both keyed to a qualified person's certification meeting the certification requirements of Rule 902(11) or (12). Rule 902(13) covers "[a] record generated by an electronic process or system that produces an accurate result." Rule 902(14) covers "[d]ata copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification" — the hash.

Each of them also states that "[t]he proponent must also meet the notice requirements of Rule 902(11)," and that provision is the whole procedural point: "Before the trial or hearing, the proponent must give an adverse party reasonable written notice of the intent to offer the record — and must make the record and certification available for inspection — so that the party has a fair opportunity to challenge them." The Advisory Committee described the amendment as providing "a procedure in which the parties can determine in advance of trial whether a real challenge to authenticity will be made, and can then plan accordingly."

United States v. Dunnican, 961 F.3d 859 (6th Cir. 2020), shows what happens when an opponent lets that window close. The government filed a pretrial notice attaching an ATF special agent's certification that he had extracted the phone data using specialized forensic software, and that the software generated a "digital fingerprint" indicating the extraction was successful, complete, and accurate. The defendant objected to neither the notice nor the method at the final pretrial hearings or at trial, arguing hearsay instead. On appeal his authenticity challenge drew plain-error review, and the Sixth Circuit affirmed.

Two consequences follow. For the proponent, the certification is cheap and forecloses a foreseeable fight. Note that the rule sets no fixed deadline of its own — it requires "reasonable written notice" before the trial or hearing, and what counts as reasonable is judged on the circumstances — so in practice the operative date is the one in the scheduling order, not the trial date. For the opponent, Rule 902(11) entitles you to inspect the record and the certification, and the Committee Note recognizes that mounting a real challenge may require technical information about the system, and possibly a forensic expert — which is a reason to ask early rather than at trial. The rule imposes no response window, but Dunnican is the cost of silence: an authenticity objection not made below is reviewed only for plain error.

The certifications are also narrower than they look. The 2017 Note to Rule 902(13) states that a certification under that rule "can establish only that the proffered item has satisfied the admissibility requirements for authenticity"; the Note to Rule 902(14) says a certification under it "can only establish that the proffered item is authentic." Both add that the opponent remains free to object on other grounds — including hearsay, relevance, or, in criminal cases, the right to confrontation. A 902(14) certification is a ticket past one gate, not into the courtroom.

When the chain does not wobble but breaks

In civil litigation, if custody failures cause ESI to be lost outright, the analysis leaves Rule 901 for Federal Rule of Civil Procedure 37(e), which reaches information "that should have been preserved in the anticipation or conduct of litigation" and "is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery." Only then does the rule engage at all. On a finding of prejudice to another party, the court "may order measures no greater than necessary to cure the prejudice." The severe remedies — presuming the lost information was unfavorable, instructing the jury that it may or must so presume, dismissal, or default — are available "only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation."

Negligent custody failures therefore produce curative measures, not case-ending sanctions. The severe remedies require a finding of intent, and a disorganized log is not that finding. Where the fight is over collection methodology rather than a lost dataset, a court-appointed neutral is frequently the faster path; see our guide to working with a discovery special master.

The pre-production checklist

Before ESI leaves your control, it is worth confirming on the record:

1. Source identification. Device make, model, serial number, capacity — or, for cloud sources, tenant, account identifiers, and date range.
2. Acquisition method. Tool name and version, write blocker model, or the API export path and its audit log.
3. All three hash values, with the algorithm named.
4. A custodian-by-custodian log with timestamps, from seizure through delivery to the review platform.
5. Storage. Where the original sits, who has access, and how that access is controlled.
6. A named certifier, identified before the collection rather than after, who can describe the system — Vinhnee is what happens to witnesses who cannot.
7. Notice dates calendared, in both directions, against the scheduling order.

Hashes do double duty at production. Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007), described hash values as usable during discovery of electronic records "to create a form of electronic 'Bates stamp'" and as distinctive characteristics permitting authentication under Rule 901(b)(4). Agreeing on hashing at the Rule 26(f) conference costs far less than litigating authenticity later — and the same discipline applies to material pulled from third-party platforms, covered in our primer on authenticating social media evidence.

Learn more

Legal Cyber Academy faculty teaching in eDiscovery and cyber incident response include Katherine Charonko, Partner and ESI Practice Group Leader at Bailey & Glasser; Gregory M. Sleet, a JAMS neutral who spent twenty years on the U.S. District Court for the District of Delaware, seven as chief judge; James Orenstein, a JAMS neutral and former U.S. Magistrate Judge for the Eastern District of New York; and Gail Gottehrer, Vice President for Global Litigation, Labor & Employment, and Government Relations at Fresh Del Monte Produce, Inc.

This article is general information about evidentiary practice, not legal advice, and does not create an attorney-client relationship. Rules, advisory committee notes, and technical standards change; verify the current text before relying on any authority discussed here.