Glossary
What is chain of custody?
Chain of custody is the continuous record of who captured a piece of online evidence, when, how it was stored, who accessed it, and what happened to it afterward. It lets a reviewer verify that a file has not been altered since capture, without relying on memory or assumption.
The term comes from physical evidence handling, where an unbroken chain shows that an object in a courtroom is the same object collected at a scene. Online evidence needs the same discipline applied to a different kind of object: a capture of something that may no longer exist at its original source by the time anyone reviews it. That makes the capture event itself part of the record, alongside every later step: storage, access, review, and export.
A useful custody record does not need to be elaborate. It needs a short, consistent vocabulary applied every time: who captured an item, when, where it was stored, who accessed it and in what role, what was derived from it (an annotation, a redaction, a translation), and which export version went to which recipient. The original capture stays frozen; everything built from it points back to it rather than replacing it. That single discipline is what lets a skeptical reviewer ask "how do we know this is what was actually captured?" and get an answer from the log instead of from memory.
Finium's evidence workflow treats chain of custody as the spine that connects every other step, capture, hashing, timestamping, and export, into one inspectable record. A custody log does not, by itself, decide whether material is authentic, relevant, or actionable; it establishes that the handling of the material can be checked. Legal characterization and admissibility questions remain with the law firm or qualified counsel reviewing the file.