Litigation Hold vs Chain of Custody: The Difference

Litigation Hold vs Chain of Custody: Two Different Obligations

Litigation hold is the duty to preserve information in systems when litigation is reasonably anticipated; it prevents destruction. Chain of custody is the chronological documentation of everyone and everything that has touched an evidence item from collection through final disposition; it proves integrity has been maintained. They operate on different timelines, invoke different obligations, and trigger different remedies when breached.

The Core Distinction: Purpose and Scope

The two obligations are adjacent in the lifecycle of digital evidence but fundamentally different in what they require.

Litigation hold (preservation duty) is an affirmative obligation to prevent destruction. When a party is under a duty to preserve information because of pending or reasonably anticipated litigation, intervention in the routine operation of an information system is one aspect of what is often called a "litigation hold."[1] It applies to electronically stored information (ESI) within an organization's systems—email servers, databases, file shares, backup storage, and mobile devices—before that information has been formally collected as evidence. The trigger is notice that litigation is reasonably foreseeable. The obligation is to suspend ordinary deletion and destruction practices.

Chain of custody (evidence documentation) is a system of record-keeping. The chain of custody begins the moment an item of evidence is recognized and collected. This chain must remain unbroken from the time an item is collected through to its final disposition. A chain-of-custody report identifies all people and places that have held an item, in chronological order, from collection to disposition.[3] It applies once information has entered the forensic or legal investigation pipeline. The obligation is to document every transfer, access, and change in custody, creating an auditable trail that proves the evidence has not been altered or compromised.

In practice: A litigation hold operates upstream, in the business systems where information lives. A chain of custody operates downstream, in the evidence room, the forensic examiner's lab, and the lawyer's file.

When Preservation Duty Begins: The Trigger

The duty to preserve arises earlier than chain-of-custody documentation and is triggered by a different event.

Many court decisions hold that potential litigants have a duty to preserve relevant information when litigation is reasonably foreseeable.[1] Rule 37(e) of the Federal Rules of Civil Procedure specifies that the duty applies only if the lost information should have been preserved in the anticipation or conduct of litigation and the party failed to take reasonable steps to preserve it.[1] The critical moment is when the party "should have known" that litigation was coming. In applying the rule, a court may need to decide whether and when a duty to preserve arose. Courts should consider the extent to which a party was on notice that litigation was likely and that the information would be relevant.[1]

Notice can arise through explicit threat (a cease-and-desist letter, a demand for payment), the filing of a complaint, a complaint in another matter, a notice of government investigation, or the pattern of business conduct that would alert a reasonable person to foreseeable litigation. There is no single moment: it is fact-dependent. But once notice exists, the duty to preserve is immediate.

Chain of custody, by contrast, begins at the moment evidence is collected—not when litigation is anticipated. A forensic examiner collecting a device, a custodian handing over emails, a law enforcement officer seizing a computer—at that moment, the chain of custody begins. The person receiving the item becomes the first link in the chain.

Chain of Custody: From Collection Through Custody

Chain of custody is not one document or one moment. It is a continuous record.

The chain of custody chronicles any activity associated with the evidence item, including isolation of subsamples from the original (parent) item.[3] Every time the evidence is moved, examined, copied, transferred, or returned to storage, that activity must be recorded: who handled it, when, for how long, for what purpose, and in what condition.

Integrity of the chain matters because of a fundamental principle: If an item's chain of custody is compromised, the integrity of the item itself is compromised, thus potentially rendering the item and any evidence derived from it inadmissible.[3] The chain is not optional. It is foundational to whether a court will accept the evidence as genuine.

NIST SP 800-86 emphasizes that the integrity of the information and maintaining a strict chain of custody for the data are required when evidence enters the forensic pipeline.[2] The forensic pipeline—the moment evidence is collected—is where chain-of-custody documentation must commence.

The Timeline: Two Different Moments

A hypothetical timeline illustrates the distinction:

Consider an organization facing potential wrongful-termination litigation after terminating an employee. The organization recognizes that litigation is reasonably foreseeable and issues a litigation hold. Email deletion policies are suspended. The employee's device is flagged for preservation rather than standard redeployment. No chain-of-custody record exists yet because no one has collected evidence as part of an investigation.

Weeks or months later, the employee files suit. In the course of discovery, the organization's counsel decides to examine the preserved device to respond to document requests. When examination begins, the device is moved from general IT storage to an eDiscovery vendor's lab. At that moment, a chain-of-custody record is created. The vendor logs receipt: the date, the time, the condition, the serial number, any visible damage. From that moment forward, every hand-off must be documented.

The litigation hold was in effect without a chain-of-custody record. The chain of custody begins only when the evidence enters active custody for examination or production.

Why Both Matter in Digital Evidence Practice

They matter because they prevent different harms and arise under different rules.

Violation of the litigation hold invokes Rule 37(e). A party that fails to preserve information it should have known was relevant to foreseeable litigation faces sanctions—suppression of the evidence, adverse inference instructions to the jury (the "missing evidence" instruction), or other consequences depending on the court's judgment about the spoliation.[1] The duty is prospective: don't let it be destroyed.

Violation of chain of custody invokes evidence law and admissibility rules. An evidence item whose chain has been broken—where there are gaps in documentation, where handling cannot be accounted for, where access by unauthorized persons is not recorded—becomes vulnerable to challenge on authenticity and integrity grounds. The witness may be impeached. The evidence may be excluded. The chain is retrospective: prove what happened to it.

Both can be breached in a single matter, but they are breached at different stages and have different remedies.

Illustrative Example: The Data Breach Investigation

Consider a corporate data breach investigation as an illustration of how the two processes operate in sequence:

A cybersecurity incident is discovered. The organization's legal counsel recognizes that litigation against the attacker, third-party liability claims, and regulatory fines are reasonably foreseeable. A litigation hold is issued. The IT department disables ordinary account deletion schedules; cloud services are instructed to preserve email and files for accounts potentially affected by the breach. No chain-of-custody documentation is created yet. The hold is an operational intervention to prevent destruction.

Subsequently, external counsel retains a digital forensics firm to examine the compromised email accounts and extract evidence of the breach. The firm issues a formal evidence receipt when they gain access to the cloud environment. From that moment forward, chain-of-custody records are created for each extracted artifact: the email export file is logged, including its hash value, the date and time of extraction, the examiner's name, and the storage location. When the export is transferred to the law firm, a new chain-of-custody entry is made: transferred by [Examiner A], received by [Counsel B], date, time, condition. If the file is later sent to a graphics expert for analysis of embedded images, another entry is added.

The litigation hold prevented destruction from the moment of incident discovery. The chain of custody, beginning when evidence was formally collected for examination, proves that every copy, transfer, and examination has been recorded and the original has been protected.

Common Misunderstandings

Misunderstanding 1: "We have a litigation hold, so we don't need chain-of-custody records."

False. The litigation hold preserves information; it does not document what happened to it. Chain of custody is required once evidence is collected, regardless of whether a litigation hold preceded it.

Misunderstanding 2: "Chain of custody only matters in criminal cases."

False. Civil discovery requires authentication of evidence under Rule 901 of the Federal Rules of Evidence. Chain of custody is a primary method of authenticating digital evidence in any proceeding—criminal, civil, regulatory, or administrative.

Misunderstanding 3: "The litigation hold is a legal document; chain of custody is a forensic procedure."

Partially true, but misleading. Both are legal obligations. A litigation hold is a business process enforced by law. Chain of custody is a forensic and legal procedure enforced by evidence law. Both matter to courts.

Misunderstanding 4: "Once the litigation hold ends, chain of custody ends."

False. The litigation hold may end when the litigation settles or concludes. But chain of custody continues until evidence is either destroyed (in accordance with a court order or retention schedule) or transferred to permanent archival. The chain does not close; it is transferred or terminated by formal decision.

Key Principles for Practitioners

1. Litigation hold is preventive: It stops destruction before evidence is collected.
2. Chain of custody is defensive: It proves integrity after evidence is collected.
3. Different timelines: Litigation hold begins at notice of foreseeable litigation. Chain of custody begins at collection.
4. Different audiences: In-house counsel and IT departments manage holds. Forensic examiners, eDiscovery vendors, and evidence custodians manage chain of custody.
5. Different consequences: Breach of a hold invokes spoliation sanctions. Breach of custody invokes admissibility challenges and integrity questions.
6. Both are mandatory: In any matter involving digital evidence, plan for both. Preserve information when litigation becomes foreseeable. Document every custody transfer and access from the moment evidence is collected.

The two obligations are complementary. Litigation hold without chain of custody leaves you with preserved evidence you cannot prove is authentic. Chain of custody without litigation hold may protect evidence you were not obligated to preserve. Together, they ensure both that evidence exists and that its integrity is documentable.