Evidence Chain-of-Custody Form
An evidence register and transfer log for security incidents: ID, description, source, collector, UTC time, SHA-256 hash, storage location and every hand-over, plus a twenty-step handling checklist. The summary flags missing hashes, times and unverified transfers.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Record each evidence item as it is collected: ID, description, source, who collected it, when (UTC), its SHA-256 hash and where it is stored. Log every transfer and verify the hash on receipt. The handling checklist covers order of volatility, hashing, storage, legal hold and release. The summary flags any item without a hash, time or custodian, and any transfer whose hash was not verified.
Your context
Evidence register
One row per evidence item. Times in UTC (YYYY-MM-DD HH:MM). Hash the item at collection and record the full SHA-256 value.
Transfer log
Every time an item changes hands, add a row. Verify the hash on receipt.
Before collecting
Counsel has been told evidence is being collected, and the investigation is set up under privilege where that is the plan
A case number exists and every item ID uses it
Collection follows order of volatility: memory and live network state before disk, disk before logs that are safe elsewhereRFC 3227material
Collection tools are trusted, run from external media or a known-good source, and their versions recorded
The time offset between each source system and UTC is recorded
Collecting
Each item records who collected it, when (UTC), from where and with what tool
Each item is hashed with SHA-256 at collection, and the hash recorded in the registermaterial
Analysis is done on working copies; the original image is never mounted read-write
Contemporaneous notes are kept: what was done, by whom, when, and anything unexpected
For cloud and SaaS sources, exports record the tenant, the query or filter used and the time range
Physical devices are photographed in place and bagged with a tamper-evident seal and seal number
Storing
Evidence storage is access-controlled to named people, and access is loggedmaterial
Evidence at rest is encrypted, with keys held by the evidence custodian
Retention and legal hold are applied, so automated deletion cannot remove evidence or the source logs
Hashes are re-verified before findings are relied on (reports, notifications, claims) and at case close
Evidence is stored away from the environment under investigation, so an attacker still inside cannot reach it
Transferring and releasing
Every transfer is in the transfer log with both names, the time, the purpose and the methodmaterial
The receiver verifies the hash on receipt and records the result
Sharing with third parties (forensic firm, insurer, regulator, law enforcement) is approved by counsel first
Return or destruction of evidence at case close is recorded with date and approver
What this template gives you
- Evidence that cannot show who held it, when, and that it has not changed is easy to challenge, in court, with a regulator, with an insurer or in an indemnity claim.
- Every item gets an ID, a source, a collector, a UTC time, a SHA-256 hash and a storage location. Every hand-over goes in the transfer log, with the hash checked on receipt.
- The handling checklist covers privilege, order of volatility (memory before disk), clock offsets, cloud export details, storage, legal hold and release.
- The summary counts the gaps a challenger would look for: items with no hash or time, hashes in the wrong format, and transfers that were never verified.
Frequently asked questions
What is chain of custody in incident response?
A continuous record of who collected each evidence item, when, how, where it has been stored and every person it passed to, with a hash that shows it has not changed. It lets you prove that the memory image or log export you rely on is the same one taken from the system.
Which hash should I record for digital evidence?
SHA-256 is the usual choice today. Older guidance often used MD5 or SHA-1; both have known collision weaknesses, so if a tool only produces those, record SHA-256 as well.
What is order of volatility?
Collect the evidence that disappears fastest first: memory, running processes and network connections before disk images, and disk images before logs that are safely stored elsewhere. RFC 3227 describes the idea. Rebuilding or rebooting a machine before capturing memory loses evidence for good.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.