Skip to content

Guide library

Guides to chain of custody and digital evidence.

A standing reference for people who have to account for evidence: what a custody record contains, how electronic material is authenticated, what a hash value settles, and how an item is handled from collection through to presentation. Every page cites its sources, and every checkable claim is read back against them before it publishes.

24 guides published across the four subjects below.

Get an email when a new guide publishes.

Most recent

Hash Verification & IntegritySeptember 10, 2026

MD5 vs SHA-256 in Digital Forensics

SHA-256 is substantially more resistant to collision attacks than MD5 and aligns with federal cryptographic standards; MD5 remains legally defensible for copy authentication under FRE 902(14) but exposes evidence to cross-examination challenge about its known practical weaknesses.

Read the full guide

What this library is, and how it is made

A reference shelf, not a news feed

Each guide answers a single question of the kind that gets typed into a search box at the moment it matters — who signs a transfer, what an unexplained interval in the record costs, whether a screenshot stands on its own, what a re-computed digest actually settles. The subjects were chosen because they recur in evidence work rather than because they were topical the week they were written, so a page from June is worth the same in December. When one falls behind, it is rewritten in place and keeps its URL instead of being replaced by a newer post at a new address.

Where the material comes from

Guides are drafted with AI assistance against a fixed brief, then read back against their sources by a separate review pass. A statement that can be checked — a rule number, a holding, a date, an attribution, a figure — either carries a citation to an approved source or it does not publish. The approved list is courts and court records, government and law-enforcement agencies, standards bodies, and open-access scholarship. Vendor marketing and SEO blogs are not acceptable sources for anything a reader might rely on, ours included. Sources are listed in full at the foot of every guide, so the reasoning can be checked rather than taken on trust.

What these pages will not tell you

The guides carry general information about evidence-handling practice, not legal advice, and none of them predicts what a court will do — that is decided by a judge on the record in front of them, case by case. Nor will a guide describe this product as having been assessed against a published standard by anybody: the design is informed by FRE 901 and NIST SP 800-86, which names what we read and claims nothing further. Our own records are tamper-evident — alteration is detectable, not prevented — and the guides are held to exactly that wording.

The full editorial standards — sourcing, verification, and corrections →

The four subjects

Everything here sits under one of four headings. Each has a hub page that covers the subject at length and lists what is still to come; the titles beneath link straight to the guide.

Digital Evidence Admissibility

What has to be shown before a judge will look at a message, a screenshot, a photograph, or a page capture — and the routes that let a written certification do the work of a live witness.

Hash Verification & Integrity

Why a short string of hexadecimal is worth anything: which algorithm, what a re-computed match settles, when the original value was taken, and how linking entries makes a later edit visible.

Evidence Handling Workflows

Procedure — the stages an item passes through, what each stage is expected to leave behind in writing, and where two organisations' records of the same handoff are most likely to disagree.

Who this work comes up for

The same custody record does a different job depending on who is holding it. Each page covers the workflow, the vocabulary, and the templates that fit that practice.

Reading about custody records is not the same as having one.

5 free Authenticated Chain of Custody Forms every month — no card required.