Chain of Custody Log
Fillable template for devices, drives and forensic images. Print it or save as PDF. One log per item. Every transfer of possession gets a line, including transfers inside the same office.
Item
| Case or matter | |
|---|
| Item number | |
|---|
| Description (make, model, color) | |
|---|
| Serial / IMEI | |
|---|
| Condition on receipt (power state, damage, locked) | |
|---|
| Image file name | |
|---|
| SHA-256 hash of image | |
|---|
| Hash verified by / date | |
|---|
Transfers
| Date and time | Released by | Received by | Purpose | Location / seal number | Signatures |
|---|
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
Rules that keep the log defensible
- Record the hash before and after any copy, and after any transfer. A matching hash is the proof nothing changed.
- Originals are sealed after imaging and are not examined. Examination happens on a working copy of the image.
- Any gap in possession is explained on its own line, even if it was a locked drawer overnight.
- Photograph seals and serials at every transfer.
- The person who receives the item signs at the moment of receipt, not later.
Imaging, hashing and custody on examined devices are performed by a Maine-licensed investigator in our network. This template is provided for counsel and client use. (207) 300-5046.