Topic hub
Evidence Handling Workflows
The lifecycle of an item from collection through presentation, the published guidance that describes each stage, and the duties carried by the people handling it along the way.
About evidence handling workflows
The lifecycle, and what each stage leaves behind
Evidence handling is usually described as a sequence: identification, collection, acquisition, preservation, transfer, examination, and presentation. The names vary between procedures and some collapse two stages into one. What matters more than the vocabulary is that each stage is expected to leave an artefact behind — an entry, a signature, a digest. A stage that produces none is a stage nobody can describe afterwards, and afterwards is when it is asked about.
The guidance most procedures reference
Two publications sit behind most written procedures in this area. ISO/IEC 27037 covers identification, collection, acquisition and preservation, and sets out principles including auditability. NIST SP 800-86 describes a forensic process aimed at incident work. Both are guidance rather than certification schemes: a procedure can reference them, and nobody is assessed against them by writing one. Treating them as a source of structure, rather than as a badge, is the honest use.
Duties travel with the item
Someone is accountable at every point — whoever collected it, whoever stored it, whoever released it, whoever received it. The boundaries between those people are where records come apart: an agency handing to a laboratory, a security team handing to counsel, an examiner handing to an instructing attorney. Recording both halves of every boundary is close to the whole discipline in one sentence, and it is the half-recorded handoff that surfaces later as a gap.
Each stage leaves a signed, chained entry instead of a note somebody has to remember — collection, handoff to counsel, handoff to a vendor, return.
Published guides
Start here
Digital Evidence Handling Procedures: A Practical Overview
Answers the question “digital evidence handling procedures”.
Digital Evidence Standards: NIST SP 800-86 and ISO 27037
Answers the question “digital evidence handling standards NIST SP 800-86”.
Evidence Custodian Responsibilities
Answers the question “evidence custodian responsibilities”.
Evidence Room Management Best Practices
Answers the question “evidence room management best practices”.
Chain of Custody in eDiscovery: Collection to Production
Answers the question “chain of custody for ediscovery”.
Also planned for this hub
The full outline this subject is being written to, so you can see what is covered and what is still coming. The 10 titles below are not yet written and are not links.
- Transferring Evidence Without Breaking the Chain
- Litigation Hold vs Chain of Custody: The Difference
- Chain of Custody in Expert Witness Testimony
- Preserving Evidence During Incident Response
- Collecting Evidence From Cloud Services
- Receiving Evidence From a Client: What to Record on Day One
- Collecting Evidence From an Employee's Device
- Writing a Digital Evidence Handling SOP
- Seizing Computers and Phones as Evidence at a Scene
- Chain of Custody for Forensic Science Students
Each is listed above as a link once written — subscribe on the guide index to be told when they publish.
Common questions
- What are the stages of digital evidence handling?
- Identification, collection, acquisition, preservation, transfer, examination, and presentation — though procedures name them differently and some collapse two into one. Common to every version is that each stage changes who is accountable for the item, and each of those changes is what the record has to capture. Digital Evidence Handling Procedures: A Practical Overview →
- What should be recorded at each stage?
- At minimum: what the item is, in terms that fit exactly one item; who acted, and in what capacity; the time, with a zone; the method or tool used; the condition of the item; and, for digital material, the digest and when it was taken. Anything the record does not say is something a witness has to remember instead. Digital Evidence Handling Procedures: A Practical Overview →
- Does the recipient need to acknowledge a transfer?
- A handoff recorded by the releasing party alone is half a transfer. The receiving party's acknowledgement is what closes it, and it is the half most often missing from informal handoffs — a folder in shared storage, a drive left on a desk, an emailed export. CustodyTrack seals a transfer only once both parties have signed.
- How does a litigation hold differ from chain of custody?
- A hold is a duty not to destroy. A custody record is documentation of what happened to what was kept. Satisfying the first says nothing about the second: a preservation notice does not show who took custody of the collected set, or that the set produced months later is the one that was collected.
Related subjects
- Chain of Custody
Who held an item, when, and what the record has to say about each handoff.
- Digital Evidence Admissibility
Authentication, the certification routes, and the exhibit types that draw the most argument.
- Hash Verification & Integrity
Digests, what a match establishes, and how chained records make alteration detectable.
Reading about custody records is not the same as having one.
5 free Authenticated Chain of Custody Forms every month — no card required.