Documenting Digital Evidence
How to document chain of custody from seizure to courtroom. Forms, photos, notes, and what to do when things go wrong.
Why documentation matters more than the evidence itself
Perfect forensic image. Matching hash values. Zero contamination. Defense counsel asks one question: "Who had access to this drive between Tuesday and Thursday?" You check your notes. Nothing logged. The case just got harder.
Chain of custody documentation proves the evidence is the same item you seized and nobody tampered with it. Miss a signature, leave a time gap, or write vague descriptions and opposing counsel will argue you lost or contaminated evidence. Judges have excluded technically perfect evidence because the paperwork had holes.
The seizure: Document before you touch anything
Walk into a room with a computer running. Stop. Before you touch it, document what you see.
How To: Document Digital Evidence at Seizure
- Stop and observe: Before touching anything, note the device state (powered on/off, screen contents, connections)
- Take overview photos: Capture the entire scene showing device location and surrounding area
- Take close-up photos: Document screen contents, cable connections, serial numbers, physical damage
- Write contemporaneous notes: Record date, time, location, who is present, exact observations (do this at the scene, not later)
- Document identifying details: Make, model, serial number, asset tag, capacity, color, physical condition, unique marks
- Complete chain of custody form: Fill out evidence description, seizure details, case number, date/time
- Package and seal: Place in anti-static bag or Faraday bag (phones), seal with evidence tape, sign across seal
- Transfer with signature: Hand to evidence custodian, both parties sign custody form with timestamp
Time required: 15-30 minutes per device | Tools needed: Camera, chain of custody forms, evidence bags, evidence tape
Take photos
Computer powered on or off. Monitor displaying what (login screen, email program, web browser with specific site open). Cables connected where. Position in the room. Nearby devices (external drives, phones, USB sticks). Overview shots showing the whole desk, then close-ups of identifying features.
Why this matters: Defense might claim you planted the computer or moved it from another location. Photos with metadata timestamps prove the scene as found. Use a camera that embeds EXIF timestamps. Phone cameras work but download photos immediately so timestamps do not get lost if the phone breaks.
Write contemporaneous notes
Date, time, location, who is present, what you observe. "Seized Dell laptop from desk in northwest corner of bedroom. Power on, monitor displaying Gmail inbox logged in as suspect@gmail.com, external Seagate 2TB drive connected via USB on left side." Specific. Not "took computer from room."
Write these notes while at the scene. Not back at the office three hours later. Contemporaneous notes have more credibility in court. If you must write them later, note the delay and explain why.
Describe the evidence precisely
Make, model, serial number, asset tag, capacity, color, physical condition. "Dell Latitude 5520, 15-inch, silver, serial 3XYZ789, Windows 11 Pro sticker, small crack lower-right corner of LCD, 512GB SSD per BIOS screen." Someone reading your description six months later should be able to pick the exact device out of a room full of laptops.
Chain of custody forms
Every agency has forms. Some are good, most are not. The form needs these fields at minimum.
Evidence description
What it is (laptop, phone, external drive). Make, model, serial, identifying marks. Where found (123 Main St, bedroom, top drawer of desk). Case number. Date and time seized.
Custody log table
Every transfer gets a line in the table: Date/time received, received by (name, badge number, signature), date/time released, released to (name, badge number, signature), purpose (imaging, analysis, court transport), location (evidence room locker 15, forensic lab station 3, courtroom 2A).
Condition notes
Powered on or off when seized. Physical damage. Seals intact or broken. Packaging type (anti-static bag, Faraday bag, cardboard box with evidence tape). Each person who receives the evidence checks condition and notes any changes.
Transfers and access
Every time the evidence changes hands, document it. Detective to evidence custodian. Evidence custodian to forensic examiner. Examiner back to custodian. Custodian to prosecutor for court. Each transfer needs signatures from both people and timestamps.
Common mistake: Unsigned transfers
You hand the drive to the examiner and walk away without getting a signature. A week later you need to prove who had it. The examiner says "I do not remember, might have been last Tuesday or Wednesday." Gap in the chain. Defense argues tampering could have occurred. Get signatures every time.
Access logs
Someone needs to examine the evidence without transferring custody. They open the sealed bag, image the drive, reseal it, and return it to the locker same day. Log this access: who, when, why, what they did, condition before and after. Examiner signs the log. Supervising officer signs too if policy requires.
Storage and security
Evidence goes in a locked room or cabinet with restricted access. Log everyone who enters. Some agencies use electronic locks that record every entry automatically. Physical locks need a manual log.
Temperature and environment
Hard drives do not like extreme heat or humidity. Evidence rooms should be climate-controlled. If your evidence locker is in an un-airconditioned warehouse that hits 110 degrees in summer, document this. Might matter if the drive fails later and you need to explain why.
Faraday bags for phones
Seized phones go in Faraday bags to block cell signals and prevent remote wipe commands. Log when you place the phone in the bag and seal it. If someone opens the bag later to examine the phone, they log the opening, examination, and resealing.
Examiner actions
Forensic examiner receives the evidence, checks the seal, confirms it matches the description. They image the drive, compute hashes, analyze the image. All of this gets documented.
Definition: Forensic Image
A forensic image is a bit-by-bit copy of a storage device that captures all data including allocated files, deleted files, unallocated space, and system metadata. Unlike a standard file copy, a forensic image preserves the exact state of the device at the time of acquisition, enabling analysis without modifying the original evidence. Forensic images are typically stored in formats like E01 (EnCase), AFF (Advanced Forensic Format), or raw DD images.
Definition: Write Blocker
A write blocker is a hardware device or software tool that allows read-only access to storage media, preventing any modifications to the original evidence during forensic imaging or analysis. Write blockers intercept write commands at the hardware level (SATA, USB, IDE) while allowing read operations, ensuring that the examiner cannot accidentally alter timestamps, create log files, or modify data on the evidence drive. NIST-tested write blockers are required for forensic soundness in legal proceedings.
What examiners should log
Date and time received. Condition on receipt (seal intact, device powered off, no visible damage). Tools used (FTK Imager 4.7.1, EnCase 8.11). Write-blocker model and serial. Original evidence hash. Image hash. Analysis start and end times. Findings summary. Date and time returned to custody.
Detailed examiner notes go in the forensic report. Chain of custody form gets a condensed version: "Received 2024-02-15 14:00, imaged with Tableau T8u write-blocker, SHA-256 hash matches, returned to evidence 2024-02-16 09:30."
Court transport
Prosecutor needs the physical drive for trial. Evidence custodian releases it, prosecutor signs, transport officer delivers it to court, court clerk signs. After trial, clerk releases it back to transport officer, officer returns it to custodian, custodian logs it back into evidence storage. Every step documented.
What if evidence is lost in transport?
Rare but happens. Van gets stolen with evidence inside. Courier loses a package. Document the loss immediately. File incident report. Notify prosecutor and judge. You might still have the forensic image and can present that instead of the physical drive. Not ideal, but the chain of custody for the image is separate and might be intact.
When things go wrong
Nobody is perfect. Forms get missed. Signatures forgotten. Devices accidentally powered on. The key is documenting problems immediately and transparently.
Gap in the chain
Detective logged receiving the laptop Monday but the next entry is the examiner receiving it Wednesday. Nothing logged Tuesday. Write a supplemental report. Interview everyone involved. "Detective Ramirez states the laptop remained in his locked desk drawer Tuesday while he was in court. Desk is in secured office accessible only to Detective Ramirez and Sergeant Lee. Video surveillance confirms no unauthorized entry." Not great, but better than silence.
Wrong serial number on form
You wrote serial 3XYZ789 but the actual serial is 3XYZ798. Typo. Fix it with a supplemental report. "Chain of custody form dated 2024-02-15 incorrectly listed serial as 3XYZ789. Correct serial is 3XYZ798, verified from device label and BIOS screen on 2024-02-20 by Detective Smith. Photographs attached. Device description in all other respects accurate." Attach corrected photos showing the right serial.
Device powered on accidentally
You opened the laptop to check the serial number and it powered on (lid switch). Screen showed the Windows login screen. You immediately powered it off. Document it. "Device accidentally powered on 2024-02-15 at 11:45 while checking serial number. Power on duration approximately 10 seconds. Windows 11 login screen displayed, no interaction with OS. Device immediately powered off. Subsequent forensic imaging confirmed no user login occurred per event logs." Honesty preserves credibility.
Digital chain of custody
Physical evidence needs physical documentation. Digital files (forensic images, extracted data, reports) need digital chain of custody.
Hash values as proof of integrity
Compute SHA-256 hash of the forensic image file immediately after creation. Document the hash in your report. Before trial, rehash the file. Hashes match? The file is unchanged. This proves digital chain of custody mathematically.
Access logs for digital files
Store forensic images on a server with access logging. Every time someone opens, copies, or modifies the file, the system logs who, when, what they did. Read-only shares prevent accidental modification. Some forensic labs use write-once storage (WORM) that makes files physically immutable after creation.
What prosecutors and judges look for
Prosecutors want continuous custody with no gaps. Judges want clear documentation they can understand without technical expertise. Defense counsel will look for any weakness to challenge admissibility.
Red flags that invite challenges
Time gaps with no explanation. Unsigned transfers. Vague descriptions ("computer"). Forms filled out days after seizure. Broken seals without explanation. Different serial numbers in different documents. Evidence stored in unsecured locations. Access by unauthorized personnel.
Green flags that withstand challenges
Contemporaneous documentation with timestamps. Every transfer signed by both parties. Precise descriptions with photos. Continuous secured storage. Access restricted and logged. Problems disclosed and explained. Hash values matching. Independent verification (second examiner confirms findings).
Related resources
Related pages:Digital Evidence Guide | Hash Values Explained | Social Media Evidence | Email Evidence Collection | Mobile Device Forensics | Cloud Evidence Preservation
See also:Audit Trails & Chain of Custody | Forensic Notetaking Guide
Frequently asked questions
One gap can sink your case. Defense will argue that during the undocumented period, someone could have tampered with the evidence. Document the gap immediately when you discover it. Write a supplemental report explaining what happened, who had the evidence, and any mitigating factors. Better to disclose it yourself than have opposing counsel discover it during cross-examination.
Technically yes, but it looks bad. Forms should be filled out contemporaneously (at the time of the action). Backdating forms is evidence tampering in some jurisdictions. If you must complete forms later, note the actual completion date and explain why the delay occurred. Never lie about when you completed documentation.
Yes for anything that might move or change. Photograph the computer as found (monitor on/off, what is displayed, cables connected, position in the room). If you seize it without photos and defense claims you planted it, you have no proof of original location. Digital cameras timestamp photos automatically, which helps establish the scene.
Document why you cannot store it normally. For example, a server rack might stay on-site in a locked room with restricted access. Log everyone who accesses the room. Install cameras if possible. Take photos showing the security measures. The point is proving continuous custody and security, regardless of physical location.
Depends on the situation. If they might destroy evidence or become violent, no. If it is a civil case or cooperative suspect, sometimes yes for transparency. Document their presence in your report. If they make statements during seizure ("That computer has nothing on it anyway"), write them down. Could be useful later.
Detailed enough that someone else could identify the exact item from your description alone. "Dell laptop" is too vague. "Dell Latitude 5520, 15-inch, silver, asset tag FN-2024-089, serial 3XYZ789, Windows 11 sticker, crack on lower-right corner of screen" is good. Include photos showing identifying marks.
Document it immediately. Write the date, time, and circumstances in your report. Explain what happened when you powered it on (password screen, automatic login, encryption warning). Accidents happen. Hiding them destroys your credibility. Disclosing them preserves it.
Automatic evidence documentation
Forensic Notes logs every action automatically. Who created what, when, where. Complete audit trail from first note to final export. Chain of custody that survives court.