Glossary term
Chain of custody
Definition
The documented record of provenance, time, source, and handler for every artifact across collection, analysis, and reporting. A maintained chain of custody is what makes digital findings defensible before internal review, regulators, and courts — without it, open-source evidence is difficult to admit.
In practice
Chain of custody is a record, not a feeling. It answers who handled an artifact, when (in UTC), from where, by what method, and what changed afterwards — with cryptographic hashes fixing integrity at the moment of capture.
It aligns with ISO/IEC 27037, the international standard for identifying, collecting, acquiring and preserving digital evidence. The test is boring by design: months later, someone uninvolved can reconstruct exactly what was collected and prove it unchanged.
All 19 terms
Browse the full glossary, or ask us how these disciplines combine in practice.