Chain of Custody in the Digital Age
Chain of custody is a story about a piece of evidence that has no gaps. Digital evidence makes the story easier to tell — and easier to break.
Chain of custody answers one question for every piece of evidence: who had it, from the moment it was collected to the moment it is presented, with no gap during which it could have been altered. For physical evidence that means bags, seals and signatures. For digital evidence it means something both simpler and more fragile.
Why digital is fragile
A photograph on a phone can be edited without a trace. A file copied between drives loses its original timestamps. An email forwarded is a new email. The evidence itself does not change, but the story about it acquires gaps — and a gap is all opposing counsel needs.
What an unbroken digital chain looks like
- Collected into the record, not onto a device. Upload from the phone directly into the case at the scene. The upload time is recorded by the server, not the phone's clock.
- Numbered on arrival. A sequence on the evidence table mints a reference when the row is saved. The photo is attached to the row; the row carries the time, place and collector.
- Never edited in place. Files in Herarx are stored encrypted and are not modified after upload. A new version is a new file with its own timestamp.
- Every access logged. Who viewed the file, who downloaded it, when. View and download counts on the file; the full trail on the case timeline and in the audit log.
- Transfers recorded. Sharing the case with counsel is a share event with a named audience and a date. Sending the file is a logged send from the case.
The audit trail is the chain
Herarx's audit log records actions with the actor, the time and the target, and it is written by the system rather than by the person being audited. Members cannot edit it. Exported alongside the evidence table, it is the chain-of-custody statement — not a document someone wrote afterwards, but a record that was being written all along.
Advanced Security for sensitive matters
Where the evidence itself must be limited to a handful of people, an Advanced-Security case encrypts it with its own key and hides the case from everyone else, including workspace admins. Deletion of such a case is subject to disclosure requests, so it cannot quietly disappear.
The habit
Collect into the case. Number on arrival. Never copy out to "work on it". Everything else follows from those three.
