Chain of Custody: The Concept Your Clients Keep Violating Without Knowing It

Typical Timing of Calls After the Funeral

After the funeral service, a family is typically settling the estate of the father of the patriarch. One issue that arises is regarding a large transaction the father made in his final days. Most likely the transaction was facilitated via email communication.

The family member thinks the father’s laptop contains the information needed to resolve the issue. Thus, the family member decides to open the laptop, guess the password correctly on the third attempt, and spend the evening reviewing the fathers’ financial records. The family member finds some of what they were looking for. As such, they send several of the relevant emails to themselves. Then they share those emails with their sister.

At this point, the matter becomes contentious. The family hires an attorney, who asks the same question as many other attorneys: can we use what is on the laptop or in the cloud?

The honest response is “possibly” but it just became much more difficult. That difficulty is due to a concept most people have heard of but very few understand except in terms of criminal law. The concept is called “chain-of-custody.”

Understanding “Chain of Custody”

Chain of custody is not a form, seal, or procedure although it involves each. Chain of custody is simply an answer to one question that every court in every type of proceeding wants to know about evidence – How do we know this is what you claim it to be?

As stated previously under the Federal Rules of Evidence and the Pennsylvania Rules of Evidence that mirror the Federal Rules --the party introducing evidence must establish that the evidence introduced is what it purports to be. This is easier to do with physical evidence. Digital evidence, however, is far from easy. That is because digital evidence has a characteristic that physical evidence does not -- examining it alters it.

Each time a computer boots, it makes entries. Each time a timestamp updates. Each time a cache is refreshed. Each time logs roll over. Hundreds of files are updated each time a system boots. Every time a smartphone synchronizes data moves from both directions. Every time a reasonably innocent individual opens a document “to look,” they modify that document’s metadata -- i.e., create a new entry indicating when they accessed it and by whom. That modification cannot be reversed.

Documentation of a continuous chain of custody serves to enable a forensic examiner to demonstrate that no modifications were made to the evidence in manners that matter. Documentation includes a continuous, signed record of who possessed the device, when, for what reason(s), and what occurred to it -- along with cryptographic fingerprints (i.e., hash values) that provide mathematical proof that the data analyzed during month three is identical on a bit-by-bit basis to the data captured on day one. When the chain remains intact, an authenticity challenge fails. When there are gaps within a chain of custody, opposing counsel will live in that gap.

How Families Intentionally Break the Chain -- Unknowingly Every Time

In criminal prosecutions, individuals possessing potential evidence are managed from initial receipt by professionals. In estate disputes, civil actions, and family law actions (which are where digital evidence currently appears most frequently) the first parties to contact devices containing potential evidence are always non-professionals -- family members.

Three scenarios are typical of why chain-of-custody breaks occur.

• The family member who takes a look. A family member decides to start-up the deceased's computer to review account balances, pictures, etc. The action taken by the family member is perfectly normal. However, once a family member starts-up the deceased's computer, thousands of files are modified/over-written and multiple access-timestamps that could potentially be important become obsolete. Moreover, should the matter later become disputed and an attorney requests an explanation for why certain items of evidence were removed/accessed during this time-period and/or were subsequently unavailable -- and since there was no documented chain-of-custody regarding these events -- it is impossible to determine whether or not access occurred.

• The executor who syncs the phone. An executor connects a deceased's mobile telephone to their own personal laptop in order to complete a backup of all data contained upon the deceased's telephone -- an understandable act given the interest of the executor in ensuring continued operation of all systems associated with the deceased. Although backing up a device is considered prudent, syncing a device represents a two-way exchange of data. Data from the executor's personal system may transfer onto the deceased's telephone and thus create a mix of data from two different entities -- none of which existed contemporaneously with each other. Additionally, all subsequent backups completed utilizing this method would be copies created by interested persons outside any documented procedures for creating such backups and without any reasonable expectation as to what aspects of these copies accurately reflect any aspect of the original data.

• The IT person who runs forensics (often, stated as diagnostics) Family members' technically knowledgeable friends or an employer's technical support personnel examine a device in order to "determine what exists." IT Support and Forensic Analysis appear similar from an external perspective; however, they represent entirely distinct disciplines. IT performs work on live systems while continually altering them as part of standard operations. Forensic Analysis operates on an exact replica of the original system, solely for purposes of preserving original content. By the time a diagnostic completes its operations -- it is too late; any possibility of recovering an accurate representation of the device as it existed on date X has vanished. Additionally, IT analysts have no training in courtroom presentation, chain of custody - which gives anyone who disagrees a strong position to challenge the findings.

These actions are not performed maliciously nor with negligence defined as it generally applies within the legal context.

However, all three scenarios carry significant implications for litigants when their case proceeds to either a trial or a probate hearing.

Consequences Associated with Broken Chains

To clarify: breaking a chain-of-custody does not necessarily preclude admission of evidence into court. While courts possess discretionary authority, gaps in chains-of-custody affect only the weight assigned to such evidence and not its admissibility per se; also experienced counsel can successfully admit even otherwise questionable evidence based upon sufficient demonstration of reliability as to source.

However, when chains-of-custody are broken in civil or probate contexts (as opposed to criminal), practical consequences include:

* Any gap in chain-of-custody becomes subject to cross-examination by opposing counsel.* Access to digital evidence that occurs without documentation becomes an alternate theory of potential tampering or destruction.* Any conclusions derived from evidence will bear an asterisk (i.e., uncertainty) since all statements made about the evidence may be challenged relative to how it was treated by others prior to being admitted as evidence.* Parties seeking to rely upon evidence must expend additional resources/time/counsel credibility to defend how others treated potential evidence (rather than demonstrating what evidence indicates).

Further, sometimes damage resulting from broken chains-of-custody result in loss of data altogether. Metadata erased by usage post-mortem cannot be recovered.

Preserving Chain-of-Custody

Fortunately, preserving chains-of-custody appropriately for families requires little beyond not taking certain actions.

Once an electronic device has potential relevance for resolving issues related to estates, investigations, or disputes: Do Not Power-On Device; Do Not Charge-Check It; Do Not Sync-Backup It; Do Not Let IT Image It Using Ordinary Tools; Document Where Located Upon Discovery & Who Has Handled It Since That Point; Secure Location; Engage Person Whose Function Includes Preservation.

What a forensic examiner does next is seldom visible to families: Document Condition Of Device Prior To Handling It; Obtain Working Copy Utilizing Write-Protection Techniques Such That Original Is Never Altered; Generate Cryptographic Hashes Which Will Anchor All Subsequent Actions; Log All Transfers And Access From This Point Forward On Continuous Record Regarding Chain Of Custody; Store Original Safely; Analyze All Other Data Via Copies Only; And Produce Written Answers With Signatures To Court Questions Relative To Chain Of Custody.

Elevator Speech

If nothing else is retained from this article retain this -- whenever an electronic device may be pertinent to a legal matter, estate dispute, or investigation -- the single-most valuable thing that can happen to it is NOTHING until it is properly preserved by an expert.

This means:

• Prior To IT Examining It;

• Prior To The Family Member Examining It;

• Prior To You Examining It;

The evidence will keep. What won't keep is the ability to prove it's evidence.