Chain of custody software
Short answer: chain-of-custody software helps check whether digital files have changed and records their handling. It hashes each file at intake, preserves the original, and packages the case so a reviewer can verify it against the recorded hashes.
Chain of custody software: what it is, where digital custody breaks, and how to evaluate it
Chain of custody software is software that helps check whether digital files have changed and records their handling. It hashes each file the moment it arrives, preserves the original, records intake, custody, edit and export events with who and when, and packages the case so the next reviewer can check it against the recorded hashes. In the physical world that is a signed log and a sealed bag. A digital file can be copied, opened, and re-saved without leaving a mark, so handling records and integrity checks matter at intake, storage, transfer and disclosure.
This page is the full model the rest of the site refers back to. Other pages link here for the complete explanation.
- Chain of custody software helps check whether digital files have changed and records their handling.
- It hashes each file at intake with SHA-256, preserves the original, writes intake, custody, edit and export events to an append-only log, and ships an export the next reviewer can check.
- Custody gaps can begin at intake and arise again during storage, transfer or disclosure. Document the process and test its controls.
- Four capabilities make it real: hashing at intake, preserved originals, an append-only audit log, and a verifiable export. You can check each one directly.
- EMP owns the intake boundary. It is tamper-evident, not tamper-proof, NIST SP 800-86 / 800-101 aligned as a design target, and the court decides admissibility.
What chain of custody software actually does
Chain of custody is the unbroken record of who handled a piece of evidence, when, and what they did to it, from the moment it entered your control to the moment it reaches a court, regulator, or opposing party. Software supports that record for digital evidence: it fixes the bytes with a hash, keeps the original unchanged, logs intake, custody, edit and export events against a time and an actor, and packages the case so the next reviewer can check it.
It is not an acquisition tool and not a review platform. Acquisition tools (Cellebrite, EnCase, Magnet Axiom) image devices and pull their contents. Review platforms help a team read, tag, and produce documents at volume. Chain of custody software is the layer between. It owns the integrity of the case file: provenance, hashing, preservation, audit, and a verifiable hand-off. Use the combination your investigation requires.
Why does chain of custody break at intake?
Copying a file can change its filesystem timestamps without changing its contents or SHA-256 hash. Re-saving, converting or recompressing it can change the bytes. Record the source details and preserve the original at intake.
Integrity has to be set at the boundary: the instant evidence crosses into your control. Hash the file and preserve the original then, or you have nothing to prove it is unchanged. The change may already have happened. Shared storage and spreadsheets can support custody procedures, but their access controls, version history and logs need configuration and retention. Add a retained hash baseline and an explicit hand-off check. And intake is where evidence integrity is kept or quietly lost.
The capabilities that matter
“Chain of custody” is cheap to put on a slide. What makes it real is checkable, one capability at a time.
Hashing at intake. Every file gets a SHA-256 hash the moment it arrives. Not on demand, not later. SHA-256 is the floor; MD5 and SHA-1 are legacy and weak. The hash anchors everything after it. If a fresh hash differs from the recorded one, the bytes changed.
Preserved originals. After intake the canonical file is fingerprinted and preserved unchanged. Working copies and derivatives live as separate objects that point back to the original by hash, never as edits to it. If the vendor says “the user is responsible for not overwriting,” they don't have this.
Append-only audit log. Intake, custody transfer, edit, export: each material event is recorded with a time, an actor, the object, and the result, and the log can only be added to. A log you can edit defeats itself. One you can't export is theater.
Verifiable export. The hand-off package stands on its own, readable with no vendor software: a manifest of one row per object and its hash, the audit trail, the case data, the derivatives. The next reviewer re-hashes the bytes and confirms the match.
How to evaluate a tool before you buy
Run a structured evaluation, not a demo. Ask the vendor these directly:
- Does it hash on intake, automatically, with SHA-256, and preserve the original at the same moment?
- Is the audit log append-only, attributed per entry, and exportable to CSV or JSON?
- Which events does it record, and which does it skip? A vendor should be able to answer both.
- Can I open the export package outside your software, and does it carry a manifest and hashes a third party can verify?
- What leaves the machine? Evidence content, file paths, case metadata. What exactly touches you?
- Show me where the export event lands in the audit log. Can you prove that entry wasn't backdated?
- Can I run a real case end to end on a trial, not sample data?
Then run the test that settles it. Produce an export, hand it to a colleague, open the manifest, recompute a few hashes with sha256sum or PowerShell, and walk the audit trail with nothing installed. If the package verifies on its own, the integrity is real. The answers tell you whether the discipline was built in or bolted on.
Where EMP fits
EMP is built for the intake boundary, where digital custody is easiest to break. It doesn't replace Cellebrite, EnCase, or Axiom, and it isn't a review platform. It takes responsibility for evidence the moment it lands, and everything after.
EMP hashes every file on intake, preserves the original, and writes intake, custody, edit, export and administrative events to an append-only log. It does not record every read or click; the integrity model lists exactly which events it keeps. Import is file and CSV only, with no named connectors. Enable the manifest to include file checksums and a standalone verifier. Standard and Professional add Chain of Custody and Audit Timeline. Use the package verifier to check an export, or the SHA-256 tool to calculate a file hash.
EMP Intake Workstation runs on a Windows workstation, on a local SQLite store. It is $29 to $99 per workstation per month for Core, Standard, and Professional, available now. EMP Intake Teams is the PostgreSQL build for shared cases, with a Workspace API on your own infrastructure. Its pilot is planned for 2027. Neither product asks you to upload evidence to our cloud, and no cloud AI touches it.
What EMP does not claim
Defensibility comes from restraint as much as capability. EMP is not a FIPS-validated cryptographic module; it computes standard SHA-256 and claims nothing more. Audit entries are append-only during ordinary application use. Authorized case purge and its retained audit record are governed separately by retention controls. An administrator with direct workstation and database access remains a trust boundary. Package hashes detect changes made after export; on their own they do not prove that records were not altered before an export was generated. That is the difference between tamper-evident and tamper-proof: file hashes, preserved originals, and an append-only log make ordinary alteration provable, not impossible.
EMP doesn't replace a physical chain-of-custody log; it sits underneath one. Its design target is alignment with NIST SP 800-86 and SP 800-101, a discipline, not a certification. SP 800-101 references concern handling and exporting mobile-device evidence acquired elsewhere, not extraction from a device. And no software guarantees admissibility; the court decides that. What EMP makes provable is the case file: the events logged, the hashes verifying, the originals unchanged. The place to start is a real case on a trial, with an export you check yourself.
Try it on a real case
Both ways to put this to the test are free and self-serve:
- Start the 14-day trial and run one real case from intake to a verifiable export, at Professional tier, no card.
- Verify a sample export in your browser first: re-hash a real EMP package against its manifest, nothing installed, nothing uploaded.
What is chain of custody software?
It records evidence handling and helps check file integrity. Staff still need to record physical transfers and handling outside the software. In practice: hash every file on arrival with SHA-256, preserve the original, log intake, custody, edit and export events append-only, and produce an export the next reviewer can verify on their own. It sits between acquisition tools that image devices and review platforms that process documents at volume.
Why does custody break at intake?
Copying can change filesystem timestamps without changing the file's contents. Re-saving or converting can change its bytes. Hash and preserve the original at intake, and record source details separately.
What are the must-have capabilities?
Four: hashing every file at intake, so a reviewer can later recompute it and confirm nothing changed; preserved originals, where edits live as separate referencing objects; an append-only audit log that times and attributes each material event and exports in a machine-readable form; and an export whose per-object hashes the next reviewer can confirm with off-the-shelf tools, no vendor software needed.
How do I evaluate a tool before buying?
Run a real case on a trial, not demo data, then produce an export and check it yourself: open the manifest, recompute a few hashes with sha256sum or PowerShell, walk the audit trail with nothing installed. Confirm it hashes and preserves on intake, keeps an append-only exportable log, ships a self-contained package, and is straight about what leaves the machine.
Does it replace Cellebrite, EnCase, or Axiom?
No. Those image devices and extract their contents. Chain of custody software is the integrity layer around that output: what came in, when, from whom, with what hash, who handled it, what got exported. EMP complements their file outputs; it does not perform device acquisition.
Is EMP certified or guaranteed to make evidence admissible?
No. EMP aligns with NIST SP 800-86 and SP 800-101 as a design target, not a certification, and it is not FIPS-validated. It is tamper-evident, never tamper-proof. No software guarantees admissibility; the court decides that. EMP supports file-integrity checks and recorded handling, not a guaranteed outcome.
Keep reading or try EMP Intake
Put defensible chain-of-custody intake to work on your own matters.