Chain-of-Custody Record¶
Custody protocol — instantiates Identity-Bounded Change
Holds an artifact's identity intact through every handoff by logging who held it, when, and what they did — an unbroken, tamper-evident chain of possession.
When an artifact passes through many hands between its origin and the moment someone relies on it, the worry is not "did it change?" but "is this still the very item it started as, or was it swapped, lost, or tampered with along the way?" Chain-of-Custody Record answers that by making possession the thing it tracks: every transfer, handling, and transformation is logged in an unbroken, sealed, append-only sequence, each step signed by the person releasing and the person receiving. Its defining move is to ground the identity claim in continuity of custody rather than in the artifact's own properties — the item is the same item because there was never an undocumented moment in which it could have become something else. A single unexplained gap in the chain, not a change in the artifact, is what breaks the guarantee.
Example¶
A forensic blood sample is collected at a crime scene. The moment it is drawn it goes into a sealed, labelled container, and the seal is initialled. From there the chain begins: the collecting officer signs it over to the evidence locker; the locker custodian signs it out to the lab courier; the courier hands it to the analyst, who signs, breaks the seal under a logged procedure, runs the assay, reseals, and signs it back. Every hop records who, when, and what was done, and no interval is left blank.
Months later at trial, the defense challenges whether the sample tested is the sample drawn. The record settles it: an uninterrupted, dual-signed custody trail with intact seals authenticates the sample as the one collected — or, if there were an unlogged overnight gap between locker and lab, that single lapse is enough to put its admissibility in doubt, regardless of how clean the lab work was. The chain's completeness, not the plausibility of any one step, is what carries the identity.
How it works¶
- Log possession, not properties. Each entry names the releasing party, the receiving party, the timestamp, and the action taken — a custody event, appended and never edited.
- Seal against substitution. Tamper-evident packaging (an initialled seal, a hash, a numbered evidence bag) makes any covert swap or opening visible at the next handoff.
- Require dual authentication. A transfer is valid only when both sides attest to it, so no custodian can silently insert or remove a link.
- Treat gaps as breaks. The integrity claim rests on there being no unaccounted-for interval; an undocumented window is a failure of the chain, not a minor omission.
Tuning parameters¶
- Custody granularity — whether handoffs are logged person-to-person or department-to-department. Finer tracking hardens the provenance but adds friction to every transfer.
- Tamper-evidence strength — from an initialled bag to a cryptographic hash of the artifact. Stronger seals catch substitution and silent alteration but cost more to apply and verify.
- Authentication rigor — single signature, dual sign-off, or dual sign-off plus a witness. Higher rigor deters collusion at the price of speed.
- Break tolerance — what counts as a fatal gap versus a documented, explainable lapse. A strict rule maximizes integrity but discards more otherwise-useful artifacts.
- Retention scope — which artifacts warrant custody tracking and for how long, trading assurance against recordkeeping burden.
When it helps, and when it misleads¶
Its strength is that it converts "is this the same item?" into a checkable record: an unbroken, signed, sealed trail authenticates the artifact by the impossibility of an undocumented swap.[n1] That makes it the evidentiary backbone wherever identity must survive many custodians — forensics, pharmaceutical cold chains, art provenance, regulated samples.
It misleads in two ways. First, custody continuity is not content integrity: a sample can degrade, be contaminated, or be mishandled while the chain stays perfectly unbroken — the record proves nobody unaccounted-for held it, not that it is unchanged. Second, its classic misuse is the chain reconstructed after the fact to paper over a gap that was noticed too late — a trail signed retroactively to justify a conclusion already drawn. The discipline that guards against both is to log handling and transformation events, not just transfers, and to record contemporaneously — a link written days later is not the same evidence as a link written at the handoff.
How it implements the components¶
provenance_record— the chain is the provenance: an origin-to-present account of who possessed the artifact, with no missing links.transition_record— each transfer or handling is captured as a before/after custody transition with actor, timestamp, and signatures.audit_trace— the sealed, append-only log is the tamper-evident trace an auditor or court can replay end to end.
It does NOT define the persistence criterion or run the continuity test (identity_persistence_criterion, identity_continuity_test) — that belongs to Identity Continuity Review; and it does NOT mint or bind the artifact's permanent identifier (persistent_identity_binding) — that is Persistent Identifier Resolver.
Related¶
- Instantiates: Identity-Bounded Change — supplies the possession-continuity evidence the same-entity judgment leans on when an artifact passes through many hands.
- Sibling mechanisms: Conservation Treatment Record · Event-Sourced Entity History · Persistent Identifier Resolver · Document Revision History · Legal Amendment Record · Policy Amendment Register · Split/Merge Change Log · Version Control System · Identity Continuity Review · Replacement or Fork Decision Record
Editorial Notes¶
Form Classification¶
Form family: Record, Log & Register
Rationale: Holds an artifact's identity intact through every handoff by logging who held it, when, and what they did — an unbroken, tamper-evident chain of possession, making its operative form a durable record, ledger, register, or trace whose value depends on preserving actual state or history.
Independent corroboration: The frozen evidence defines Chain-of-Custody Record as 'Holds an artifact's identity intact through every handoff by logging who held it, when, and what they did — an unbroken, tamper-evident chain of possession', so its operative form is Record, Log & Register.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Criminology & Forensic Studies
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Forensic evidence practice established identity-preserving records of who held an artifact, when, under what seal, and what was done to it.
Related originating lineages:
- Law & Governance — Admissibility and authentication rules give an unbroken record its evidentiary force.
- Library & Information Science — Provenance metadata generalizes the record to digital artifacts and transformation histories.
Review resolution: Criminology and forensic science is the agreed primary lineage because an unbroken, tamper-evident sequence of possession establishes evidence identity. Law and archival provenance materially shape authentication and preservation, while the record remains a single forensic lineage with multi-domain use.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
Custody continuity and content integrity are different guarantees, and the record only provides the first. It certifies that possession was never unaccounted-for; it says nothing about whether the artifact stayed fit for its purpose in the meantime. Where the content itself can silently drift — a chemical sample, a living tissue — the chain of custody must be paired with a separate integrity or condition check.
[n1] Chain of custody is the evidentiary requirement that an item be authenticated as the same thing it purports to be, established by an unbroken record of its handling. A demonstrable break in the chain can render otherwise-probative evidence inadmissible — which is why the mechanism treats an undocumented gap, not a change in the artifact, as the failure condition. ↩