Receiving Evidence From a Client: What to Record on Day One

What Must Be Documented at Receipt

A chain of custody record serves one essential function: it permits a court to follow the path of an item of evidence from its origin through collection, transfer, storage, and analysis, and to assess whether the item remains in substantially the same condition as when you received it. The chain begins with receipt, not with later review.

When a client hands you evidence, you are the first custodian in a legal sense, and your receipt record will be scrutinized. Documenting that receipt requires capturing five categories of information: the identity of the item, the date and time of receipt, the condition of the item, the source (the client), and your role as recipient [1][5].

The item's identity means describing it with sufficient particularity that it could be distinguished from other items and recognized later. A description might read: "One Apple iPhone 13, Space Gray, IMEI 35-XXXXXX-XXXXXX-X [illustrative], powered off, sealed in original packaging, received in a locked hard-shell carrying case." For documents, "Four printed pages, letter-size, dated March 15, 2024, initialed in bottom right corner by hand" suffices. For digital files on media, note the storage medium type, capacity, any visible labels, and the file count or sizes if known [1][5].

Date and time must be recorded contemporaneously—at the moment of receipt, not hours or days later. The entry should include the calendar date and, ideally, the time to the nearest hour or minute. This contemporaneous notation protects against later challenges about when the evidence entered your custody and signals that you did not alter or inspect the item in the interim [1][5].

Condition notation is critical. Inspect the item briefly for obvious damage, alteration, or unusual state. For a device, note whether it is powered on or off, if there is visible battery life, if there are cracks or corrosion, if any seals are intact or broken. For a document, note creases, stains, tears, or evidence of copying. For a storage device, note any physical seals or evidence of tampering. Do not open, boot, or analyze the item at this stage; you are recording what you observe from the exterior [1][5].

Source documentation means recording the client's name, organization (if applicable), the date the client claims to have acquired or observed the evidence, and the client's account of how they came to possess it. If the client states they recovered the item from a specific location, date, or event, record that account as the client stated it, without editorializing or analysis [1][5].

Your identification is straightforward: your name, title, organization, and the capacity in which you are receiving the evidence (attorney, investigator, forensic examiner, litigation consultant, or other role).

Why Contemporaneous Recording Matters

Court authentication standards generally focus on establishing that an item is what it is claimed to be and has not been altered in a material way. A contemporaneous receipt record, made at the time of transfer while the client is present, does several things: it memorializes the client's account of the item's origin and condition, it establishes that you did not alter the item before documenting it, and it creates a documentary touchstone against which later condition descriptions can be measured. If the item is later found to be in a different condition, a clear receipt record allows you to pinpoint when any change occurred and to account for it [1][2][5].

If you wait until the next day, or until before trial, to write down what the client gave you, you face a harder problem. A court may question whether your memory is reliable, whether you have added details, or whether the item sat in an undocumented state overnight. A receipt record made on the day of receipt, signed by you and, ideally, by the client as acknowledgment of what was transferred, provides a contemporaneous basis for that account [5].

Digital Evidence: Hash Values and Copies

For digital evidence, contemporaneous documentation includes a critical step: if the item is a storage device (phone, computer, drive, memory card, SIM card, or similar), do not copy or analyze it before noting its condition. Record the device's make, model, serial number (if visible), capacity, and power state. If you have obtained a forensic image or hash of the device before receipt—because the client produced a pre-made image, for example—document that separately and note the date the image was made, who made it, and the hash value [6][7].

A hash value is a digital fingerprint computed from the contents of a file or device using a mathematical algorithm; if even a single bit of data changes, the hash changes. The ability to demonstrate that an original item and a copy are identical depends on comparing hash values [6][7]. However, at the moment of receipt, you need not yet have computed the hash. Your receipt documentation should note the item's external condition and confirm that you have not yet accessed it. The hash computation, and documentation of that hash, typically occurs during the forensic examination phase—a later step in the custody chain [7].

If the client provides you with a document or photograph as a digital file—a screenshot, a PDF, a JPEG—note the file name, the file size in bytes or megabytes, and the date the client claims the file was created or received. Do not modify the file; preserve it in its original form. If you must make a working copy for analysis, hash both the original and the copy and document that they match. This requirement applies even to digital copies, which are fungible items: the chain of custody for a copy must show that it is a true and complete copy of the original [6][7].

Condition and Changes Over Time

Some items naturally change with handling and time. Your receipt record creates a baseline documentation of the item's condition at the moment you received it, allowing later handlers to account for any changes that may have occurred during custody. For example, a device may have a different battery charge after weeks in storage, or a document may show age-related wear. By documenting the initial condition, you create a record against which any later changes can be assessed and explained [1][7].

Your receipt record does not guarantee that small changes later will be overlooked; rather, it creates a foundation for accounting for those changes. If you receive a USB drive and note that it shows no visible corrosion, a later forensic examination that reveals corrosion requires explanation. The receipt record also protects you personally: if a court later questions whether you damaged the item, a detailed receipt record describing its condition when you took possession becomes your defense [7].

A Worked Example

Suppose a client, Ms. Judith H., representing herself in a contract dispute, delivers to you a smartphone and a folder of documents on March 20, 2024, at 2:15 p.m. Your receipt record might read:

RECEIPT OF EVIDENCE

Date and Time of Receipt: March 20, 2024, 2:15 p.m.

Received by: Sarah Chen, Senior Litigation Paralegal, Chen & Associates LLP

From: Ms. Judith H. (Client, [Case No. 2026-CF-XXXX] [illustrative])

Client's Account of Source: Ms. H. states she powered off the phone on March 19, 2024, at 6:30 p.m., immediately after discovering a suspicious email from a counterparty. She states the phone has not been powered on or accessed since that time.

Items Received:

Item 1: Apple iPhone 12, Silver, IMEI 35-XXXXXX-XXXXXX-X [illustrative]. Powered off. Device is sealed in a clear plastic bag with the client's signature across the seal. No visible damage. Battery indicator shows approximately 45% battery remaining (observed through locked home screen before device was powered off). Received with original charger and charging cable in a black fabric case.

Item 2: One manila folder containing eighteen (18) printed documents on letter-size paper, dated between January 3, 2024, and March 18, 2024. Client states these are email receipts printed directly from her email account. Documents are loose, not hole-punched or bound. No visible damage to documents. Received in the order listed in the attached index.

Actions Taken at Receipt: Device has not been powered on, unlocked, or accessed. Documents have not been copied or scanned. All items placed in secure storage in the office evidence locker, Shelf B-3, under my direct observation. Client has signed below to acknowledge the accuracy of this receipt record.

Sarah Chen, Signature and Date

Ms. Judith H., Signature and Date

This record is plain, specific, contemporaneous, and defensible. It establishes what came into your custody, when, from whom, and in what state. It creates no gap at the critical moment of transfer.

Beyond Receipt: Maintaining the Chain Forward

Your receipt record is the foundation, but the chain of custody must be maintained forward. Every person who thereafter takes possession of the items—a forensic examiner, an expert witness, an intern retrieving items from the evidence locker—must also be documented, with the date, time, purpose of the transfer, and the condition of the item at the moment of transfer [1][5]. Each handler should sign or initial the custody record.

For digital evidence, if a forensic examiner returns the device to you after analysis, a new entry documents the return: the date and time, the examiner's name, the condition (unchanged or describing any changes the examination may have caused), and your confirmation that the item is accepted back into your custody [7].

If the items are held by your office until trial or trial preparation, periodic documentation of their secure storage—particularly for sensitive or fungible items—is good practice. A log entry stating "Items remain secure in evidence locker, Shelf B-3, seal intact, no access granted, [Your Name], [Date]" creates a record that nothing was tampered with during dormancy.

Special Case: Items Held by the Client

Occasionally, a client will not surrender the original item. They may provide you with copies—screenshots, forensic images, photocopies—but retain the original device or document. In such cases, your receipt documentation must clearly note that you have received only a copy, the date and medium on which the copy exists, the client's assurance regarding the relationship between the copy and the original, and the fact that the original remains in the client's possession [5][6][7]. Do not represent to later parties that you have the original if you do not.

Documentation of such arrangements protects you from inadvertent misrepresentation and preserves your ability to compare a copy with the original if circumstances later require it. It also signals to a court or expert that there is a gap in the documentary chain—the original was not in your possession—and allows for fact-finding about whether that gap affects the reliability or use of the copy [2][5].