Common Chain of Custody Mistakes and How They Surface

What Chain of Custody Records Must Document

A chain of custody record is the documentary backbone of evidence integrity. It must account for the chronological movement, location, and custodial status of physical evidence from collection through final disposition. Federal law enforcement guidance requires that the record include the date, time, and identity of every individual who collects, receives, or transfers evidence; the case number and victim or suspect name; and a brief description of the item [1], [3]. Each person in the chain must be able to attest to the condition of the evidence package (whether sealed, unsealed, or damaged), any changes to its contents, and the integrity of all transfers [3].

This deceptively simple requirement creates a web of dependencies. If any link records its receipt but the prior link fails to record its transfer, the document on its face shows a break even if no break occurred in fact. If a signature appears weeks after the transfer purportedly occurred, the credibility of the entire record comes into question. If the same evidence package is opened in a laboratory, a courtroom, or a evidence storage facility without being immediately resealed and without a new custody entry recording that opening and resealing, the record becomes silent about an interval of exposure.

Incomplete or One-Sided Transfer Documentation

When evidence moves from one person to another, both the releasing party and the receiving party should record the transaction. A common gap occurs when the transfer is documented on the releasing side of the custody form or log but not on the receiving side, or vice versa. The reasons for this are mostly administrative: forms are submitted without countersignature protocols, transfer responsibility is unclear, or custody forms stop traveling with the evidence itself [1].

This one-sided documentation does not necessarily mean the evidence was mishandled, but it does mean that the record cannot establish continuity. A prosecutor or defense counsel later reviewing the custody chain will find a recorded release but no corresponding recorded receipt. If the evidence was forensically analyzed, tested, stored in an evidence room, or introduced at trial, the gap in the written record raises the inference—however unfounded in fact—that the evidence was unaccounted for between those two points. Under Federal Rule of Evidence 901(a), the proponent of evidence must produce evidence sufficient to support a finding that the item is what the proponent claims it is. A gap in the custody record, even if only documentary, weakens that showing and invites cross-examination [11].

Unsealed or Reopened Evidence Without Custody Entry

Biological evidence, digital media, and many physical items are sealed during collection and packaging to ensure their integrity. When evidence must be opened—for laboratory examination, court inspection, or repackaging—the item must be resealed prior to storage or transfer to another entity, and this opening and resealing must be recorded with the same care as an initial transfer [4].

A sealed package that arrives unsealed, or that shows signs of having been opened but has no custody entry explaining when and why, presents a critical vulnerability. NIST guidance on biological evidence preservation recommends that agencies establish procedures to address evidence received unsealed, and law enforcement guidance states that when departments use shared temporary storage areas accessible to multiple employees, this can compromise the integrity of the evidence and become the basis for a chain-of-custody challenge [4].

The error typically unfolds in reverse. A party challenging admission of evidence will point to the sealed condition of the package at collection, then to the unsealed or altered condition of the package at the time of analysis or trial, and will observe that no custody entry accounts for the interval. The absence of a custody entry is then read as evidence that the item was handled outside the documented chain. Whether that inference is correct or incorrect, the burden falls on the prosecution (in criminal cases) to fill the gap through witness testimony. If no witness is available to testify to an unrecorded opening and resealing, or if the testimony is hearsay and inadmissible, the evidence may be excluded [3].

Gaps in Custody Documentation for Derivative Evidence

When a laboratory analyst examines biological evidence, a piece of digital media, or other evidence, the result of that examination often becomes evidence itself. A DNA extract created from a biological sample, a filtered file set produced during digital forensics, a scan or photograph made from an original document—these are derivative items. They must have their own custody documentation to the same extent as the original evidence [4].

A common mistake is to record the original evidence in the custody chain but to treat the derivative as documentation that needs no separate custody entry. The derivative may be stored in the same evidence room, handled by the same personnel, and moved with the original, but from the perspective of authentication, the derivative stands on its own. If the derivative is tested, admitted at trial, or is the basis for expert opinion, a party may challenge whether the derivative matches or accurately reflects the original, and the custody record for the derivative becomes relevant to that challenge [4].

Illustrative example: A biological sample collected from a crime scene (Case No. 2026-CF-XXXX) is received by a laboratory and recorded in the custody log on Date A. The analyst creates a DNA extract from the sample on Date B. The analyst's report describes testing performed on the extract and identifies a match to a suspect's profile. At trial, the custody record shows the transfer of the original sample but no entry for the creation, handling, storage, or testing of the extract. The defense asks: when was the extract made, by whom, how was it stored, who handled it, and how can the jury know that the extract admitted into evidence is the same extract tested by the analyst and not a different sample or contaminated material? Absent a custody record for the derivative, these questions become harder to answer, and the authenticate of the derivative—distinct from authentication of the original—is weakened [4].

Missing Entries Discovered During Review

Gaps in custody documentation surface at several points in the lifecycle of evidence. The first is often during an administrative or quality-assurance review conducted by law enforcement or a laboratory. Federal guidance requires that administrative review include a review of chain of custody and disposition of evidence [1], [2]. An auditor or compliance officer will compare the custody log to the physical location and condition of the evidence. If the log shows no entry for a transfer, storage, or examination that the physical condition of the package suggests occurred, the discrepancy is noted and investigated [1], [3].

The second point is during discovery in a criminal or civil case. A defense attorney or opposing counsel will review the custody record as part of case preparation. If the record is incomplete, inconsistent with lab reports or court records, or contains entries that are undated or lack identifying information, the gaps become evident and are typically flagged in discovery disputes or at a pretrial hearing [3].

The third point is at trial. If custody of evidence is contested—and in criminal cases, if the defendant objects to hearsay custody testimony, a live witness may be required—the gaps become visible under cross-examination. A witness may be unable to recall details of a transfer years after the fact, or may testify in a way that contradicts the written record. At that point, the record's incompleteness is exposed to the jury and to the court [7].

Working Copies and Derivative Custody Documentation

When digital evidence, biological samples, or physical evidence is examined or analyzed, examiners often create working copies, sub-samples, or derivative files for testing, while the original remains in secure storage. The question of whether a working copy needs its own custody entry is answered by the principle that derivative evidence requires independent custody documentation [4].

Federal guidance on biological evidence preservation and NIJ guidance on digital evidence both establish that evidence derived from primary samples should be documented to the same extent as the original [4], [5]. A working copy created during digital forensics, a sub-sample extracted for DNA testing, or a photograph made from an original document should have a custody entry recording its creation, the analyst or technician who created it, the date and time, the condition of the item, and its destination for storage or further testing [5].

If a working copy is created, used for analysis, and then destroyed or disposed of without being recorded in the custody log, the record cannot later demonstrate the integrity or accuracy of the analysis performed on it. If the working copy is retained but not recorded, it may be discovered during evidence storage audits or during discovery, creating an unanswered question about its origin and handling [4]. Best practice is to treat every derivative—whether working copy, sub-sample, or secondary testing result—as an independent item of evidence requiring its own custody entry and tracking [4], [5].

How Incomplete Records Affect Admissibility

A break in the chain of custody can be grounds for challenging the admissibility of evidence [1], [3]. The extent to which a gap in the custody record affects admissibility depends on the severity of the gap, the type of evidence, and the jurisdiction. In some courts, gaps in custody documentation go to the weight of evidence and do not prevent admission if some evidence of identity remains [3]. In others, a gap that prevents a reasonable finding that the evidence offered is identical to the evidence collected will result in exclusion [7].

Under Federal Rule of Evidence 901(a), authentication is satisfied by evidence sufficient to support a finding that the item is what is claimed. If the custody record is incomplete or inconsistent, that sufficiency may be in doubt. The proponent of the evidence may overcome the doubt through live testimony—a collector, handler, or examiner who testifies to their knowledge of the item and its integrity—but if no such testimony is available or credible, the evidence may not be admitted [11].

In criminal cases, if the defendant objects to the admission of evidence based on a broken chain of custody, and the prosecution wishes to rely on a written custody record rather than live testimony to fill the gap, the defendant's Sixth Amendment right to confrontation may be implicated [2]. The practical result is that incomplete chains of custody almost always trigger the need for live testimony and cross-examination, which adds cost, time, and uncertainty to a case [7].