7.2 Chain of Custody, Storage & Transfer Records

Chain of Custody, Storage & Transfer Records

Chain of custody tells the item’s story: what was collected, by whom, where it went, who accessed it, what was done, and what condition it was in. Its purpose is accountability and authentication, not ceremonial paperwork.

Start at collection

Assign a unique item number and record:

• case identifier;
• item description and serial number or distinguishing marks;
• exact collection location;
• date and time with time zone;
• collector;
• authority for collection;
• original condition;
• photographs;
• package/container; and
• initial seal.

The description should let another person distinguish the item without opening it. “One black 64 GB SanDisk USB drive, serial …” is better than “flash drive.”

Transfer record

For every handoff, record:

Avoid pre-signing blank lines. Correct an error transparently; do not erase or backdate. Electronic systems should preserve audit history and access permissions.

A courier receipt can supplement, but not replace, the investigator’s item-specific record. Verify that the recipient is authorized.

Seals

Use packaging and tamper-evident seals suited to the item. Marking the seal and package with initials/date can reveal some opening or replacement. It is not impossible to forge and should not be described as “unassailable proof.”

When opening an item:

1. photograph and record the existing seal condition;
2. open away from the original marked seal when feasible;
3. record the purpose and persons present;
4. document item condition and any sampling;
5. close with a new seal; and
6. mark and log the new seal.

Do not conceal a broken seal. Explain it and assess whether the item remains reliable.

Storage

Use limited-access storage with an item index and access log. Separate client property, evidentiary items, hazardous material, weapons, drugs, and biological material as law and safety require.

Storage depends on the item. Paper needs clean dry protection. Digital media needs protection from loss, static, physical damage, unauthorized access, and accidental modification. Biological and chemical materials require specialist packaging, ventilation or refrigeration decisions, hazard labeling, and often agency or laboratory custody.

The former draft’s fixed 60–75°F and humidity formula was not a universal Tennessee evidence mandate. Follow a qualified protocol for the actual material and document deviations.

Digital custody

Preserve the acquisition record, tool/version, operator, device identifiers, image format, start/end time, errors, and hash values. Maintain a verified master and controlled working copies. Limit administrative privileges and record exports.

A later matching hash supports byte identity with the hashed master. It does not prove that the first image captured every relevant sector, that the device was unaltered before collection, or that file contents are true.

If a working copy changes through annotation, redaction, transcoding, or clipping, give it a new identifier and hash and preserve the relationship to the master.

Irregularities and legal effect

Tennessee Rule of Evidence 901 requires enough evidence to support a finding that the exhibit is what the proponent says. Chain evidence is especially important when an item is fungible, easily altered, contaminated, or not readily identifiable.

A custody gap, unlocked vehicle, missing signature, or damaged seal is serious. Its legal effect is fact-specific. It may undermine authentication, support exclusion, or reduce the weight the factfinder gives the item. Do not promise automatic admission or automatic exclusion.

Report the irregularity immediately, preserve surrounding logs and images, stop unnecessary handling, and let counsel assess the legal response. Never “repair” the record.

Client files and legal holds

Evidence retention is driven by contract, applicable law, court order, subpoena, discovery duty, insurance requirement, and reasonably anticipated litigation. Tennessee PI licensing law does not establish a universal three-, five-, or seven-year retention period for every case item.

When litigation is pending or reasonably anticipated, follow counsel’s preservation notice. Suspend routine deletion for relevant notes, messages, originals, metadata, and backups. A client request to destroy an unfavorable item does not override a legal hold.

At authorized disposition, record approval, method, date, items, and person performing it. Return client property with a receipt. Sensitive data should be destroyed securely when lawful retention ends.

Example

An investigator receives a sealed phone from counsel, photographs the package, logs the seal, transfers it to a forensic examiner with signatures and purpose, receives a forensic image and report, verifies the image hash, and returns the physical device through documented custody. The investigator does not claim the hash proves who sent a disputed message; that question requires account, device, content, and witness evidence.

Exam method

Choose contemporaneous item identification, every-transfer logging, appropriate storage, honest irregularity reporting, and master/working-copy separation. Reject claims that one signature, seal, or hash is conclusive proof.