In criminal cases, chain of custody is a formal discipline with sealed bags and signature cards. In civil and family matters, the evidence often arrives as a client’s camera roll forwarded at 11 p.m. The question at a hearing can be the same in both settings: can you show that what you are offering is what was collected, and that nothing changed along the way?
This guide lays out a custody process scaled for small and mid-size firms. It covers the stages of a digital chain, what to record at each, how to handle evidence clients collect themselves, a log template, storage and access controls, and what to do about the gaps that inevitably exist. It is written for teams that want a defensible routine without hiring a forensic lab for every matter.
What does chain of custody mean for digital evidence?
Chain of custody is the documented history of an item from collection to court: who had it, when, and what was done to it. For digital evidence, the history has to show that the file offered is identical to the file collected, or explain every transformation in between.
Chain of custody is one way to support authentication under Federal Rule of Evidence 901 and its state counterparts, particularly for items that could be altered without anyone noticing. Civil courts generally do not demand the formality of criminal practice, and many treat minor gaps as going to weight rather than admissibility. A gap at a point where alteration was possible, however, is exactly where opposing counsel will press.
Digital evidence differs from physical evidence in three ways that shape the process:
- Copies are perfect. A copy can be bit-for-bit identical to the original, which a hash value can prove.
- Alteration is invisible. An edited screenshot looks as clean as an unedited one.
- Metadata is fragile. Forwarding, converting or even opening a file can change dates and embedded data.
Hash values and logs therefore do the work that evidence bags and seals do in a property room. The guide to hash values in litigation explains exactly what a matching hash does and does not show.
What are the stages of a digital chain of custody?
Every digital item passes through the same basic stages. The goal is a record at each one that someone could testify to later.
| Stage | What happens | What to record |
|---|---|---|
| Source | The device, account or system where the item lives | Device or account, owner, how identified |
| Collection | Screenshot, export, download or forensic extraction | Who, when, method, tool, any limits |
| Transfer | Item moves to the firm | Channel, sender, date and time received |
| Intake | Firm receives and preserves the original | Hash at receipt, item ID, received by |
| Storage | Original kept read-only | Location, access controls, backups |
| Processing | Copies converted, reviewed, redacted | Each transformation, by whom, new hashes |
| Production or exhibit | Item leaves the firm or is offered | Bates or exhibit number, recipient, hash |
| Disposition | Matter closes | Retained, returned or destroyed, and when |
How do you handle evidence that clients collect themselves?
Treat client collection as the most likely weak link and document it deliberately. In family and housing matters especially, the client is often the only person who can collect, and they do it with whatever is at hand.
The common problems are predictable: cropped or annotated screenshots, photos compressed by being texted or posted, metadata stripped in transit, and selective capture of only the helpful parts of a conversation. Clear instructions up front prevent most of them.
- Give written collection instructions. Ask for unedited originals, full conversations rather than excerpts, and no highlighting, cropping or markup.
- Provide a channel that preserves originals. A secure upload route that accepts the original file and records receipt is easier to explain than a forwarded text thread. See why firms use a client evidence submission portal.
- Capture a short collection statement. How each item was gathered, when, on what device, and whether anything was changed.
- Preserve the device. Ask the client not to reset, replace or trade in the phone or computer while the matter is pending.
- Escalate when it matters. For items likely to be disputed, consider a forensic collection so the first link in the chain is professional rather than improvised.
Template: client collection statement
Item or set: [description]. Collected by: [name]. Date collected: [date]. Device used: [make and model]. Method: [screenshot / app export / download / photo]. Source: [phone, account, app]. Was anything cropped, edited, annotated, deleted or converted before sending? [yes or no, and explain]. How sent to the firm: [channel]. Date sent: [date].
What should a chain of custody log contain?
A custody log records the item once and then every event that touches it. Keep it simple enough that staff actually use it on a busy day.
Template: custody log
Header: Item ID / Description / Source / Collected by / Collection method and date / Received by / Date and time received / Channel / Algorithm and hash at receipt / Original storage location.
Event rows: Date and time / Event (copied, converted, reviewed, redacted, produced, offered, returned) / Performed by / From and to / Hash verified (value, match yes or no) / Notes.
Events that need a row:
- Any copy to a new location, system or person outside the assigned team
- Any conversion, such as HEIC to JPEG or email to PDF, with the new file’s hash
- Redaction, Bates stamping or exhibit labeling of a copy
- Production to another party, the court, a neutral or an expert
- Re-verification before a hearing or deposition
- Return, destruction or archive at the close of the matter
How should the firm store and control access to digital evidence?
Store originals read-only and separately from working copies, limit access to assigned staff, and keep the system’s own access records. Good storage hygiene is also an ethics issue, not just an evidence issue.
ABA Model Rule 1.6(c) calls for reasonable efforts to prevent unauthorized access to or disclosure of client information, Rule 5.3 makes lawyers responsible for supervising nonlawyer staff and vendors who handle that information, and comment 8 to Rule 1.1 ties competence to understanding the relevant technology. State versions of these rules vary, so check the rules adopted where you practice.
- Originals in a read-only location or system, never edited in place
- Working copies clearly labeled and kept separately
- Access by matter assignment, with audit logs where the system provides them
- No personal email accounts, personal cloud folders or unencrypted USB drives
- Backups that preserve originals and hashes
Preservation duties also run in the other direction. Once litigation is reasonably anticipated, Federal Rule of Civil Procedure 37(e) addresses the failure to take reasonable steps to preserve electronically stored information. The litigation hold letter guide covers how to communicate that duty to clients.
What happens when there is a gap in the chain?
Acknowledge it, document it, and corroborate around it. Almost every civil matter has a gap somewhere, most often between the moment the client captured something and the moment the firm received it.
- Document honestly. Record what is known and what is not, and when you learned it.
- Corroborate. The other party’s copy of the same messages, consistent metadata, a preserved device, or a participant’s testimony can carry an item across a gap. See the common screenshot admissibility pitfalls and fixes.
- Upgrade the source. If a critical screenshot has a weak history, collect the same content again from the device by export or forensic extraction.
How do you make the chain easy to show at a hearing?
Reduce the chain to a short, testable story: who collected it, when the firm received and hashed it, and proof the exhibit matches. A one-page custody summary for each key item helps the witness and the court.
The first link inside the firm matters most, because it is the baseline for everything after it. Evidence Helper, for example, preserves each original untouched and records a SHA-256 hash the moment it arrives, so intake is logged without anyone remembering to do it; see how intake hashing works. How much foundation a particular court expects remains a judgment for the responsible attorney, licensed in the jurisdiction where the matter is pending.
