CHAIN OF CUSTODY

keycybr
4 min readApr 27, 2021

--

A chain of custody (COC) is a documented sequence of custody of material as it moves along the supply chain. Chain of custody is synonymously used with chain of security, chain of evidence and continuity of evidence. Chain of custody must assure the court of law that the evidence produced is authentic one and the it is in the custody of the officer and didn’t got tampered on its way from crime scene to forensic lab and finally to court of law.

DESCRIPTION OF CHAIN OF CUSTODY

Here the chain of custody starts with the officer who is actually investigating a crime. Here the officer makes a seizure memo and chain of custody of the evidences along with the unique ID of himself, that are found on the scene of crime and their unique description.

EVIDENCE CHAIN OF CUSTODY TRACKING FORM
  1. In the document we start with FIR no, jurisdiction of place where crime took place, date and time of investigation, who is investigating the crime and sections relating to crime by any law.
  2. Station The unique description is applicable for the digital evidences, licensed arms(fire-arms) and for things who will be providing such unique identity.
  3. Say if the Investigating Officer (IO) collected a mobile phone, then the IMEI or any unique description of that device will be taken.
  4. Say if the mobile phone found is broken/ burnt/ destroyed/ the state/condition of the evidence must be stated.
  5. Let’s say if the IO found the evidences of same kind and in same condition then how many such evidences found must be given in COC in number.
  6. If anything, unusual is found with evidence it must be stated in the remarks section of the COC.
  7. If the transfer of custody of the evidence is changed then it must be stated in the document by signing and writing his/her unique id stating when and where it’s received.

IMPORTANCE OF CHAIN OF CUSTODY

Ø The COC shows the integrity of the evidence is maintained. It must be produced to the court of law during the trail, then only it makes the admissible.

Ø The transfer of the evidence custody must be kept to minimum, still it’s not a problem to make more transfers because in most of the cases greater the transfers the integrity of the evidence is questioned.

Ø The document must be kept so that it shows that starting from the scene to making it to reach the laboratory it state is kept original and it shows the transparency of the investigation and at no place it is compromised.

Ø If the COC is challenged in the court then the document is the only proof and if prosecution fails to the challenge, then the chain is deemed to be broken and leads to the inadmissibility of the evidence.

Ø The chain of custody is particularly significant in environmental sampling that can help identify contamination and can be used to fix accountability.

FINAL DISPOSAL OF EVIDENCES

The evidences that were collected from the scene of crime will finally be either destroyed/return to lawful owner/ auctioned. When ever such actions are taken that are stated above, the signatures of at least two witnesses must be taken.

1. DESTRUCTION

The action is taken when the evidence collected is no longer of use and case is closed.

2. RETURN TO LAWFUL OWNER

The evidence analysis was over on particular thing and it is having some value in the economic way then then after verifying it to whom it belongs, it’ll be returned to the lawful owner.

3. AUCTIONED

The items like vehicles, valuables etc. will be auctioned and the Non objection certificate is issued for that thing. It is the only measure taken when the authorities fail to knowing the owner of the thing.

REFERENCE

Chain of Custody, Ashish Badiye; Neeti Kapoor; Ritesh G. Menezes. https://www.ncbi.nlm.nih.gov/books/NBK551677/

Written By Dhanvanthri Konasagaram Chippagi

--

--

keycybr

#cyberinvestigation #digitalforensics #cyberlaw #ethicalhacking #bugbounty #digitalevidence #cybersecurity #penetrationtesting #ML #OSINT #AI #databreach