Chain of Custody for Investigators: What to Log and Why

Chain of custody is the written record that identifies each person who handled an item of evidence and accounts for every period of custody between collection and trial. The National Institute of Justice (NIJ) defines it as "a recorded means of verifying where the evidence has travelled and who handled it before the trial."

The same NIJ module says the record exists to prevent substitution, tampering, misidentification, damage, contamination, loss and falsification. It has to establish the evidence's identity, authenticity and legal integrity. Authentication means showing that an item is what you say it is. Federal Rule of Evidence (FRE) 901(a) asks for "evidence sufficient to support a finding that the item is what the proponent claims it is."

The custody log starts the moment the item reaches you, whether you collected it or a client handed it over. Everything before that moment is something you can only report as told, and the log should say so.

A custody log has three parts: an intake block completed at handover, one transfer row for every later handoff, and a disposition line when the item leaves your control. Each field below has a pass test. A field that fails its test is a gap someone will ask about.

Every later handoff gets a transfer row: date and time, released by, received by (printed name and signature), purpose, and storage location. The pass test is that no signature is empty and each row's "received by" matches the next row's "released by." Opening, copying or moving an item without handing it to anyone still gets a row.

The disposition line records whether the item was returned, delivered to an attorney or destroyed, with date, name and signature.

Three questions open every handover. Where has this been since it was created or found? Who else has had access to it? Has anything been opened, copied, edited or deleted? Write the answers in the client's words.

Put the item ID on every line of the report that relies on the item. How to Write Investigation Reports That Hold Up covers the report itself.

Of the four public agency custody forms we read in October 2026, all four record the date and time of each transfer. Only one records a tamper seal and only one records the item's condition at collection. In our view, those two fields do the most to show that an item did not change between hands.

We opened the blank form from each agency and marked a field present when the form has a labeled place to enter it. The forms are Indiana Department of Health State Form 57209 (1-23), the Environmental Protection Agency (EPA) sample chain-of-custody form, the Los Angeles County Public Health Laboratory form and the North Carolina State Laboratory of Public Health form.

Four forms is a small sample, and all four are built for laboratory samples, not investigator work. The pattern is a reason for the extra fields in our custody log, not a measure of the whole field.

A laboratory receives samples collected under a known procedure. An item a client hands you arrives with its history unknown, so its condition on arrival is the only baseline you can establish. That is why the intake block puts condition, photos and seal number ahead of everything else.

A broken chain of custody usually lets opposing counsel attack how much the evidence should count, and in some cases a court may exclude it. In Wheeler v. State (Maryland, 2018) and United States v. Campbell (Fifth Circuit, unpublished), the courts treated gaps as going to weight, not admissibility.

Weight means how much the jury believes the evidence. Admissibility means whether the judge lets the jury see it. That is how those courts ruled, not a promise for every court.

In Wheeler, decided June 25, 2018, the Maryland Court of Appeals (now the Supreme Court of Maryland) held that once chain of custody is established, challenges "go to the weight and credibility of the evidence, not its admissibility." The test was whether the proof showed a reasonable probability that tampering did not occur. Wheeler is the only precedential ruling of the two.

In Campbell, an early-1990s drug-prosecution appeal in the Fifth Circuit, the court designated its opinion unpublished and without precedential value. Mismatched initials on evidence seals and differing receipt dates "relate to the weight, rather than the admissibility, of the evidence." That followed a basic showing that the exhibits were authentic.

The NIJ module is less forgiving. Without proof of an intact chain, evidence "may be excluded from trial or afforded less weight", and the jury may receive a limiting instruction on how to weigh it. A limiting instruction is the judge's direction to jurors on how they may use a piece of evidence.

Our reading is that the gap that hurts an investigator is the unexplained one. A recorded handoff with a reason and a signature can be explained on the witness stand. A missing entry cannot. Expect opposing counsel to ask either way, and make the log the answer. Our guide to testifying in court covers the stand itself.

Which rule applies depends on the court and the case, so ask the attorney who retained you. This page is not legal advice. Whether you were permitted to collect or receive the item is a separate question from custody; what a private investigator license does and doesn't cover is the place to start on that. For broader grounding in evidence rules and court procedure, see our Legal Aspects of Private Investigation course.

Record a hash value the day a file arrives, keep the original untouched, and work only from copies. A hash value is a number a program calculates from a file's contents. A copy that produces the same number as the original is an exact duplicate.

The Federal Rules of Evidence give that practice a use in court. Rule 902(14) lets data copied from an electronic device, storage medium or file be authenticated "by a process of digital identification," shown by a certification of a qualified person, without a live witness. The committee notes tie this to hash values. The party relying on it must give the other side advance notice. Rule 901(a) still governs everything else: the item must be shown to be what you claim.

Our recommendations for investigators:

• Keep native files, meaning the original file with its metadata (the date and device details stored inside it), not screenshots.
• Log every export and copy as a transfer row.
• Never rename or re-save the original.
• Tell the retaining attorney that the hash exists, because whether a certification will be used is the attorney's decision.

Our Collection and Preservation of Evidence course covers chain of custody in three lessons. It has 30 self-paced lessons, takes about 4 hours and costs $80 as of October 2026.

We teach the full handling sequence the custody log depends on: physical evidence defined, systematic processing, search methods, incident scene photography, sketching and measuring, marking and packaging, documentation and forensic testing. It covers chain of custody in three lessons: lesson 1.4 (a 62-minute video), lesson 4.4 (a 5-page PDF) and lesson 4.5 (a 3-minute video). Five progress quizzes and a final exam, 78 questions in all, lead to a certificate of completion on passing every assessment.

The course teaches how to mark, package and document an item and why the record matters. The custody log above is the document you keep. Start with Collection and Preservation of Evidence.

A certificate of completion records the training you finished. It is not a license, and whether a state board accepts a course for credit is that board's decision. Will This PI Course Count in My State? shows how to check.