CompTIA A+ Core 2 (220-1202), Domain 4, Objective 4.6 covers chain of custody and the proper handling of digital evidence once an incident has been identified and reported. When an event might lead to termination, litigation, or criminal prosecution, the technical facts are only as valuable as your ability to prove they were not tampered with. Chain of custody, order of volatility, forensic imaging, and meticulous documentation are the disciplines that keep evidence trustworthy from the moment it is collected until it is presented.
In this article you will learn what chain of custody is and why it must never be broken, how the order of volatility dictates the sequence in which evidence is captured, how technicians make a forensic copy of a drive so the original is never touched, and how every piece of evidence is tracked and documented.
What Chain of Custody Means
Chain of custody is the chronological, documented record of everyone who handled a piece of evidence, along with when they handled it, why, and what they did with it. It answers a single critical question: can we prove that this evidence is exactly what we say it is, unaltered from the moment it was collected? If any link in that chain is missing or unexplained, opposing counsel can argue the evidence was tampered with, and a court may throw it out entirely.
A proper chain-of-custody record captures, for every transfer and action:
- Who collected or currently holds the evidence, and who received it next.
- What the item is, with a detailed description and unique identifiers (serial numbers, asset tags, case numbers).
- When each collection, transfer, or examination happened — precise date and time.
- Where the evidence was collected and where it is stored.
- Why the item was handled or transferred.
The guiding principle is that evidence must be accounted for continuously. There can be no gaps. If a hard drive sits unattended on a desk overnight with no record, the chain is broken. Evidence is stored in secure, access-controlled locations — a locked evidence locker or safe — and every time it changes hands, both parties sign the custody form.