Definition
Chain of custody is the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. It ensures that evidence remains authentic and unaltered from the time it is collected until it is presented in court or used in an investigation. This meticulous process is vital for maintaining the integrity and admissibility of evidence, preventing tampering or contamination. For instance, a forensic investigator meticulously logs every step of handling a compromised hard drive, from initial seizure to data extraction. This differs from evidence logging, which focuses solely on the initial recording of evidence without detailing subsequent transfers. Understanding chain of custody is crucial for cybersecurity professionals and is frequently tested on certifications like CompTIA Security+ and CISSP.