AUDIT AND CHAIN OF CUSTODY PRACTICES

Establishing an effective chain of custody requires creating a set of procedures for which each step is documented in writing, and which are applied to the entire discovery process rather than broken into stages.

Best practices

• Restrict the number of hands that touch the evidence to minimize handling errors and mistakes.
• Ensure that software used to handle data has appropriate reporting and audit capabilities.
• Reduce the human role and increase automation (as long as it has robust reporting capabilities) as much as possible.
• Combine models of real-world chain of custody practices, such as police procedure and package shipping systems, to create an ideal solution. This may include cataloging an item by description, date of receipt, unique ID and the name of the provider, as well as creating a tracking process that allows interested parties to obtain information whenever necessary.
• Consider using a collection team trained in computer forensics to ensure that all data is properly preserved and to avoid collection errors.
• Establish three teams: a group of forensic investigators to collect evidence and document the process; a team to log, inventory and safeguard the evidence; and a team in charge of copying, fingerprinting it and analyzing the original data. These teams may overlap, however, the second team should be small and differentiated from the other teams due to its specialized skill set; these personnel need to be extremely organized and methodical, since logging and inventory processing are often the subject of the most challenge in litigation.
• Use forms for consistency and provide a copy to the person/company from whom the evidence is collected. In physical collection, the form should include at least the date, time, name of person(s) from whom the evidence was collected, and a description of the item(s) collection, including any unique identifiers such as serial number and model number. If the evidence is shipped to the electronic discovery provider, it should only be shipped via a carrier that provides excellent shipping and tracking documentation, insurance and high reliability, or through a bonded point-to-point courier. A copy of the form should be provided to the person or company from whom the evidence was collected.
• Have the electronic discovery provider take physical custody of the evidence as soon as possible after collection.
• Use a database to capture log information. Headings should include at least the following:

• Electronic discovery identification and inventory number (ideally, use a barcode labeling system);
• Date received;
• Matter name;
• Client name;
• Client/matter number;
• Name of person/company/shipper delivering evidence;
• Description of item(s), including manufacturer name, model number, unique identifier/serial number and digital fingerprint whenever possible;
• Name of person receiving evidence (“Logged by”);
• Check Out (check box�Yes/No). If “Yes,” subheadings should include date; reason; custodian name; name of recipient (used if electronic discovery provider ships evidence); name of shipper; shipper’s tracking number; date of shipment; date of receipt; and check-in date.

• Restrict access to the original evidence to only the team in charge of logging and securing it.
• Log any activities involving the original evidence; after logging, confirmation of receipt should be communicated to the evidence owner.