Keep a chain of custody CHAIN

A digest proves nothing changed; a custody log says who held it

These are two halves of one claim and neither is worth much alone. A SHA-256 tells you the file in front of you is byte for byte the file that was hashed. It says nothing about where it came from, who has had it since, or whether the copy you were given was already the wrong copy. A custody log tells you who held the material and when it moved, and without a digest attached to each entry it is a list of assertions about an object nobody can now identify.

So every exhibit here gets a reference, a description and a digest, and every hand-off records who took it, from whom, when, and why. That is the whole shape of a custody record, and the reason it reads the way it does is that the questions asked of it are always the same four.

Fill it in at the time

This is the part that decides whether the log is worth anything, and it is not a technical point. A custody record written from memory three months later is worse than no record, because it is a document that can be shown to be wrong, and one demonstrable error in it puts every other line in doubt.

Write the entry when the hand-off happens. If you do not know something, say you do not know it: “received from reception, no name recorded” is an honest line that survives being examined. “Received from J. Patel, 14:20” written from memory in March is a line that gets taken apart, and takes the rest with it.

The same applies to the awkward entries. A gap, a period where the material was in an unlocked drawer, a copy made and not logged: record it. A record with an admitted gap is a record. A record with a concealed gap is a problem for the person who concealed it.

What this is honestly not

It is not a system of record for an organisation. The log lives in this browser's local storage on this device until you export it, which means the export is the record and this page is not. Export after every working session, keep the exported file the way you would keep any other evidence, and remember that clearing browser data clears this.

It is not a signature and it cannot make anybody honest. Nothing here stops somebody writing down something untrue, and the timestamp on an entry is read from the clock of the machine that made it, which is an assertion by whoever made the entry rather than a fact about the world. What it does is make the sequence explicit, keep the digests attached to it, and produce a document that reads the way a custody record is expected to read.

Around it: PROOF hashes a whole set of files at once and tells you later whether any of them changed; PROVENANCE records a single file at the moment it reaches you, with a note of where from; ATTEST produces the certified schedule that goes with a bundle of electronic evidence; and STATEMENT seals a witness statement with a digest of its own so the text cannot be revised after signature. Everything here stays in this browser.