Chain of Custody Log: A Worked Example

What the Log Records and Why It Matters

A chain of custody log is a chronological documentation of the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence [4]. The log creates what amounts to a paper trail—or in modern practice, a digital trail—connecting each person who handled the evidence to a precise moment in time, along with the evidence's condition at that moment. The purpose is straightforward: to establish, through contemporaneous documentation rather than memory or inference, that evidence remained intact and unaltered between the crime scene and the courtroom. Before physical objects are admissible in evidence, the proponent must establish that they are in "substantially the same condition as when the crime was committed" [1]. The chain of custody log is how that foundation is laid.

Under governing standards, each person who handles the item should make a log entry documenting the fact that they handled the evidence [1]. More broadly, each person that handles the evidence must be identified, and all periods of custody must be properly accounted for and recorded [2].

The Essential Elements of a Log Entry

A defensible chain of custody log entry contains distinct fields, each serving a specific evidentiary purpose. The NIJ guidance identifies the typical checklist: the item's field location and the geographical location where it was found or observed [1]. To that foundation, every entry should include:

Identity of the handler. Not a badge number alone, but a name or identifier sufficient to distinguish one officer or examiner from another. The entry should make clear who is making the log entry itself—the person documenting the transfer, not merely the person relinquishing custody.

Date and time of transfer. Precision matters. The time should reflect when custody actually changed hands, not when the log was written hours or days later. The date anchors the record to a specific incident or investigation phase.

Description of the item. The log entry should identify the evidence by a consistent identifier—exhibit number, lab accession number, or case number—and a brief description sufficient to distinguish it from other items. For DNA evidence, the entry must contain identifiers that describe the evidence at the time it was found, such as location and position, as well as other details consistent with jurisdictional requirements [3].

Condition at receipt. This is where many logs fall short. The entry should describe the physical state of the evidence at the moment of transfer: Is the package sealed? Is the seal intact? Are initials or tamper-evident markings visible? Is the item in the same condition as documented in the previous entry? If the condition differs, that discrepancy must be recorded and investigated [7].

Reason for custody transfer. Why is this person now handling the evidence? Is it for forensic analysis, storage, transport to court, or retention? The purpose clarifies what custodian was responsible for the evidence and what may have occurred to it during that period.

Signature or authentication. Each person who transfers custody should authenticate their entry—typically through a signature, but in electronic systems, through a timestamp and user ID that cannot be repudiated. This personalizes the record and creates accountability.

A Worked Example

Consider the following illustrative log for a forensic examination of seized electronic evidence:

| Date | Time | Item ID | Item Description | Received From | Released To | Condition Upon Receipt | Purpose of Transfer | Signature/ID | |------|------|---------|------------------|----------------|------------|----------------------|-------------------|--------| | 2026-04-15 | 14:30 | EX-001 | Samsung Galaxy smartphone, IMEI 35-XXXXXX-XXXXXX-X, black, plastic case damaged on right corner, power off | Scene, Detective A. Reyes | Evidence Technician J. Kim | Device powered off, screen cracked, undamaged packaging, sealed with red tape initialed AR | Seized from scene, preliminary documentation | A. Reyes, Badge 4721 | | 2026-04-15 | 16:15 | EX-001 | Samsung Galaxy smartphone (as above) | Evidence Technician J. Kim | Forensic Examiner M. Patel, Digital Forensics Lab | Device powered off, red tape seal intact with AR initials, black evidence bag labeled EX-001 unopened | Transfer to lab for forensic imaging and analysis | J. Kim, Badge 2134 | | 2026-04-16 | 09:00 | EX-001 | Samsung Galaxy smartphone (as above) | Forensic Examiner M. Patel | Evidence Technician J. Kim | Device powered off, evidence bag opened under controlled conditions, device imaged and returned to sealed bag with new seal initialed MP | Forensic imaging completed; returned to evidence storage | M. Patel, Examiner License 1847 | | 2026-04-20 | 10:45 | EX-001 | Samsung Galaxy smartphone (as above) | Evidence Technician J. Kim | Assistant District Attorney R. Lopez | Device powered off, sealed evidence bag intact with MP initials, condition unchanged from last receipt | Production to prosecutor for review prior to trial | J. Kim, Badge 2134 | | 2026-04-20 | 14:20 | EX-001 | Samsung Galaxy smartphone (as above) | Assistant District Attorney R. Lopez | Evidence Technician J. Kim | Device powered off, sealed evidence bag intact, condition unchanged | Return to storage pending trial | R. Lopez, License 198762 |

This log demonstrates the core requirements in action. Each entry identifies a specific person. Dates and times are recorded for every transfer. The item is consistently identified by exhibit number and description. Critically, the condition column documents the physical state at each handoff—seal integrity, packaging status, device state—creating a record that allows any gap or discrepancy to surface. The log shows both who handled the evidence and what they did with it.

What This Example Shows—and What It Omits

Notice what the example includes and what it deliberately does not. The example records seal integrity because seals are the primary mechanism by which evidence is protected against tampering between documented transfers. If a seal is broken or missing, the record flags it. If a new seal is added (as when Examiner Patel completes imaging), that event is documented with initials and time.

Notice also what is not in the log: the log does not record that "the device is secure" or "chain of custody was maintained." Those are conclusions, not facts. The log records facts—who held the evidence, when, and in what condition—from which conclusions may be drawn.

Now consider what a deficient log entry might look like. Suppose the entry for 2026-04-16 had been:

| 2026-04-16 | (blank) | EX-001 | Samsung smartphone | M. Patel | J. Kim | (blank) | Forensic work | M. Patel |

This entry fails in several respects: no time is recorded, so the precise moment of transfer is unknown; the condition column is blank, leaving no record of whether the device remained in the state documented by the prior custodian; and the item description, while adequate for this simple example, might be insufficient if multiple devices were in evidence. These gaps create vulnerability. The prosecutor may be forced to call each custodian to testify about what they remember, rather than relying on contemporaneous documentation. A defense attorney may argue that the gaps permit an inference of tampering or degradation.

The federal standard illustrates this principle concretely. When specimens move through a laboratory's custody, any direct evidence of tampering or discrepancies in the information on the specimen bottles and the chain-of-custody forms must be reported within 24 hours of discovery and noted on the chain-of-custody form for each specimen [7]. The operative word is "discrepancies"—the log must record what was found, including anything unexpected.

The Role of Condition Documentation

Condition documentation is not supplementary; it is foundational. The requirement flows from the authentication of evidence itself. To authenticate evidence, a foundation witness must establish that the evidence "is in substantially the same condition as when the crime was committed" [1]. Without condition notation in the log, that foundation must rest entirely on live testimony—which is more difficult, more vulnerable to impeachment, and more dependent on the witness's memory.

A well-maintained log allows counsel to stipulate that evidence arrived in condition X and left in condition X, reducing trial time and the scope of fact dispute. It protects the custodians themselves by creating a written record that contradicts any suggestion that they were careless or malfeasant. It protects the prosecution by rendering the evidence chain transparent to scrutiny.

Common Gaps

In practice, the most frequent gaps are these: time of transfer left blank or recorded only as a date, leaving hours unaccounted for; condition fields left empty with a note like "same as before," which creates ambiguity if no prior entry can be located; handler identity reduced to initials only, making it impossible to verify who actually signed; and a single line covering multiple transfers ("transferred to lab for analysis and returned two weeks later"), which obscures what actually occurred during that period.

Each gap invites litigation. A defense counsel questioning an officer about a blank time field will ask, "Officer, you wrote nothing about when you actually transferred this evidence—correct?" The honest answer is yes, and the jury is left to wonder whether precision matters and why the officer did not record it.

Documentation in Modern Systems

Whether the log is handwritten, printed and scanned, or maintained in specialized chain of custody software, the same elements apply. Electronic logs often enforce these requirements through mandatory fields and timestamps that cannot be manually overwritten. That design discipline benefits the entire record, because it forces the custodian to consider and document condition, time, and purpose at the moment of transfer, not afterward.