Guide
Chain of custody for digital evidence
For physical evidence it's a sign-out sheet. For a digital file it's math — and the math is what survives cross-examination.
Not legal advice. Foundational and authentication requirements vary by jurisdiction. This explains the concepts; confirm what your court expects with counsel.
Chain of custody answers one question: how do we know this is the original, unaltered? For a bagged-and-tagged physical item, it's a documented trail of who held it. For a digital file — a recording, a statement, a PDF — you can copy it infinitely and edit it invisibly, so the trail has to be cryptographic.
The hash is the heart of it
A cryptographic hash (e.g. SHA-256) is a fixed-length fingerprint of a file. Change a single byte and the fingerprint changes completely. So if you record a file's hash the moment you collect it, and the hash still matches later, you've proven — mathematically — that not one bit changed in between. No hash on intake, no proof later.
What a complete digital chain of custody includes
- Hash on intake: compute and store the fingerprint when the file is first collected.
- An access log: who opened, exported, or annotated the file, and when.
- Untouched originals: work from copies; the source is never edited.
- Tamper-evidence on the log itself: the record of all this must also be unalterable after the fact.
Why the log must be tamper-evident too
An audit log you can quietly edit proves nothing. The strong pattern is a hash chain: each entry includes the hash of the entry before it, so changing any past record breaks every record after it — the tampering becomes self-evident. It's the same idea that makes a ledger trustworthy.
You can't always prevent a file from being altered. You can make any alteration impossible to hide.
How Scribe handles this
Chain of custody is the backbone of Scribe Verbatim. Every file is hashed (SHA-256) on upload and entered into a hash-chained, tamper-evident audit log — each entry sealing the one before it. Every access and action is recorded; originals are preserved untouched. When you produce evidence, you export the originals with a SHA-256 index, so the other side can verify for themselves that nothing changed. It's the difference between asking the court to trust you and handing them the proof.
Frequently asked
What is a SHA-256 hash, in plain terms?
A short, fixed fingerprint computed from a file's contents. Any change to the file — even one byte — produces a completely different fingerprint, so a matching hash proves the file is unchanged.
Why does the audit log need to be hash-chained?
So the log itself can't be quietly edited. Each entry embeds the previous entry's hash, meaning altering any past record breaks the chain from that point on and is immediately detectable.
How do I hand evidence to the other side verifiably?
Export the originals with a hash index (e.g. SHA-256 per file). They recompute the hashes and confirm a match — independent proof nothing was altered. See responding to a subpoena.