SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-chain-of-custody

What does a chain of custody record for digital evidence?

Who had custody of the evidence, when, and what was done to it.

Start playing free

  1. The cost of the forensic tools used
  2. Who handled the evidence, when, and how ✔
  3. The attacker's identity and address

Why: A chain of custody lets you show the evidence was not altered or swapped. Each transfer, examination and storage location is logged with who and when. Without it, evidence may be thrown out.

Huh, didn't know that: RFC 3227 says to document where, when and by whom evidence was discovered and collected.

The dad joke
Did you hear about the cyclops whose computer crashed? He called Eye-T.
Like this card?
Play the game

References

Answer: Who handled the evidence, when, and how. A chain of custody lets you show the evidence was not altered or swapped. Each transfer, examination and storage location is logged with who and when. Without it, evidence may be thrown out.

  1. IETF RFC 3227, Guidelines for Evidence Collection and Archiving www.rfc-editor.org/rfc/rfc3227
    Who had custody of the evidence, during what period.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhen collecting evidence from a live compromised system, which data should you capture first?Security & PrivacyAccording to RFC 3227, what should you avoid doing to a compromised system until evidence collection is complete?Security & PrivacyIn digital forensics, what is a write-blocker used for?

That's stuff everyone should know.