Digital evidence rarely disappears with a theatrical puff of smoke. It is copied, renamed, converted, moved, redacted, separated from attachments, or excluded from a production. By the time the public notices, five offices may possess five versions and everyone has developed a sudden devotion to passive voice.
Reconstructing the chain of custody means documenting where a record originated, who controlled it, which systems held it, what happened to it, and where the trail stops. This guide explains how to investigate missing electronic records without claiming more than the evidence proves.
What a Digital Chain of Custody Proves
A chain of custody is the documented history of an item from collection through transfer, examination, storage, release, or destruction. The National Institute of Justice digital evidence guide states that activity involving the seizure, examination, storage, or transfer of digital evidence should be documented and preserved for review.
The record should identify the item, source, collector, collection time, storage location, transfers, examinations, and processing changes. A complete chain does not prove the content is true. It helps show that investigators can account for what they examined.
A broken chain proves a gap, not intentional destruction. The cause may be poor management, an undocumented transfer, migration, an inadequate search, lawful disposal, technical failure, or misconduct. Resistance Kitty permits suspicion. She simply insists that suspicion wear a name tag.
Understand Hashes Before Using Them
A cryptographic hash is calculated from a file and changes when the file changes. The Scientific Working Group on Digital Evidence recommends hashing early because integrity can be verified only from that moment.
A matching hash shows that two copies are identical at the bit level. It cannot prove authorship, prior authenticity, or collection completeness. A hash is a useful fingerprint. It is not a tiny digital witness who saw everything.
Missing Does Not Always Mean Deleted
A record may be absent from a release while remaining inside the source system. It may have been withheld, referred, separated from an attachment, assigned another identifier, stored elsewhere, or missed by the search.
Describe the finding narrowly. Say that an item is absent from a specified collection as of a certain date. Do not claim destruction without evidence.
Step by Step Guide
Step One: Define the Missing Item Precisely
Record the likely creator, recipient, date, subject, file name, attachment name, case number, identifier, page count, format, and every reference to the item. “The missing video” is a complaint. “The original video identified as Exhibit 14 in the June 6 evidence inventory” is an investigative target.
Step Two: Define the Expected Collection
Identify the collection in which the item should appear, such as a case file, evidence inventory, shared drive, disclosure production, or archive. Record its dates, custodians, repositories, search terms, and stated exclusions. You cannot prove a gap until you define its container.
Step Three: Preserve the Earliest Available Copy
Download the earliest available version and keep it untouched. Record the URL, access time, file name, size, and source. Preserve the surrounding page. Use separate working copies so annotation, redaction, or conversion cannot alter the original.
The nonprofit DocumentCloud helps research organizations preserve and publish documents. Its guidance warns that optical character recognition or redaction may change metadata, so retain the original.
Step Four: Calculate and Record a Hash
Calculate a SHA 256 hash and record it with the date, tool, and person performing the calculation. Check it after transfers. Preserve every earlier value and label transformed files as derivative versions.
Step Five: Capture the Metadata
Record visible and embedded metadata, including creation time, modification time, author, software, file path, message headers, attachment names, and time zone. The National Archives metadata guidance shows why metadata is essential for identifying and preserving federal electronic records.
Metadata can be altered by ordinary processing. Treat it as evidence to compare, not divine revelation delivered by a laptop.
Step Six: Build a Custody Ledger
Create one row for every known event. Record the time, person or office, action, system, destination, version, hash, supporting document, and unresolved question. Include collection, transfer, review, redaction, publication, withdrawal, restoration, and destruction.
When an event is inferred rather than documented, label it as an inference. Empty cells are allowed. Invented certainty is not.
Step Seven: Reconstruct the System Path
Map every device, server, storage platform, case system, vendor system, archive, and website that may have held the evidence. Identify who administered each system during the relevant period.
Ask whether the agency migrated platforms, changed vendors, renamed folders, merged cases, or exported records. A file can survive while its index, link, or familiar name does not.
Step Eight: Identify Every Transformation
Determine whether the original was compressed, scanned, converted, redacted, split, combined, or processed through optical character recognition. Compare size, page count, resolution, timestamps, identifiers, and hashes.
A changed hash does not automatically establish tampering when a documented process created a new version. The problem begins when a transformed file appears without documentation and everyone becomes fascinated by the ceiling.
Step Nine: Use Other Records as Anchors
Search inventories, transcripts, emails, indexes, court filings, production logs, invoices, and correspondence for references to the item. One record can confirm another existed even when the original cannot be located.
Look for sequential gaps in identifiers and attachments referenced but not produced. Compare earlier and later inventories. One missing number may be routine. A pattern concentrated around one person or event deserves closer examination.
Step Ten: Request the Audit Trail
Request access, export, and deletion logs, transfer receipts, evidence forms, audit reports, preservation notices, search instructions, and collection reports. Ask which software and version collected or exported the material.
The SWGDE collection guidance recommends contemporaneous notes that identify tools, file counts, file names, data size, screenshots, reports, and hash values. If an agency cannot produce these basics, document the absence.
Step Eleven: Check the Retention Authority
Locate the agency records schedule covering the item. The National Archives explains that federal records cannot be legally destroyed without approved disposition authority. Unscheduled federal records must be treated as permanent until scheduled.
Record the schedule number, category, cutoff event, retention period, and authorized destruction date. Determine whether litigation, an investigation, or a preservation notice suspended disposal.
Step Twelve: Test Alternative Explanations
Test competing explanations. The item may never have been collected, may be stored elsewhere, may carry another identifier, or may have been withheld, corrupted, lawfully destroyed, or improperly deleted. List supporting and contradictory evidence.
This discipline prevents a plausible theory from dressing itself as a proven fact and demanding a press conference.
Step Thirteen: Request Preservation and Investigation
If evidence may still exist, send a preservation request identifying the item, systems, custodians, dates, and logs. Ask the records officer, inspector general, oversight body, or court to preserve material through the proper process.
Federal agencies must notify the Archivist about actual or threatened unlawful deletion, alteration, corruption, or destruction. The National Archives unauthorized dispositions page explains the reporting process and publishes case information.
Step Fourteen: Publish the Provenance With the Finding
Identify the preserved file, source, hash, custody events, transformations, missing events, retention rule, and alternative explanations. Separate confirmed facts from comparisons and inferences.
Publish enough methodology for another researcher to reproduce the result without exposing protected information, confidential sources, or sensitive evidence.
Red Flags That Deserve Attention
Warning signs include missing collection logs, unexplained identifier gaps, attachments separated from messages, identical records carrying conflicting metadata, undocumented conversions, changing page counts, broken preservation links, destruction during a pending inquiry, and public copies that differ without version labels.
Challenge claims that no records exist when inventories, invoices, transcripts, or correspondence describe them. The file may be shy. The paperwork discussing it usually is not.
What a Strong Reconstruction Should Establish
A responsible reconstruction explains what is missing, why it should exist, where it belonged, who controlled it, which versions survive, when the chain broke, and which explanations remain possible.
The goal is to replace an administrative shrug with documented events, not manufacture an accusation.
Closing Thoughts
Digital evidence can be copied perfectly and managed terribly. It can lose context, metadata, attachments, or history. It can also be concealed or destroyed. Reconstructing the trail is how we distinguish those possibilities.
Preserve the original. Record the hash. Map the systems. Follow the transfers. Show the public where the chain breaks.
Resistance Kitty knows computers do not misplace accountability by themselves. Somewhere behind every mysterious digital absence is a human decision, a system rule, or a records office experiencing an urgent outbreak of amnesia.
Sources
- NIST Guide to Integrating Forensic Techniques Into Incident Response
- National Institute of Justice Forensic Examination of Digital Evidence
- SWGDE Best Practices for Digital Evidence Collection
- SWGDE Guidance on Hash Algorithms
- National Archives Records Scheduling Basics
- National Archives Unauthorized Dispositions
- National Archives Metadata Requirements
- National Archives Litigation Hold and Freeze Guidance
- DocumentCloud
- Freedom of the Press Foundation File Safety Module
