Definition
Plain language
The documented trail showing who handled a piece of evidence and when.
As stated in the literature
In digital forensics, the recorded sequence of custody, control, transfer, and analysis of evidence, often preserved with cryptographic hashes.
Why it matters: Without it, evidence can be challenged as tampered or contaminated, and the same logic increasingly applies to AI-generated artifacts used in regulated settings.
For example, an investigator logs the hash of a seized hard drive, who copied it, when, and where the copy was stored, so the evidence stands up in court.
Heard on the show
“It's exactly chain of custody.”Episode 105 — The Trojan Is Your Agent's Memory: Why Single-Step Defenses Miss Persistent Attacks