In more detail
A complete chain shows the evidence was not altered or swapped, which is what makes it credible in court or in an internal investigation. In digital work it usually includes a Hash taken at acquisition and re-checked later to prove the data is unchanged, plus notes of each transfer and storage location. Each entry records who handled the item, when, why and where it was kept, and every person in the chain signs. The original media is sealed and stored, and analysis is done on a verified Forensic image.
Why it matters
A gap in the record, such as an unlogged weekend in someone's desk drawer, lets the other side argue that the evidence could have been tampered with, and a court may give it little weight or exclude it. The same discipline helps internal investigations and incident response, where findings may later end up in a dispute or a regulator's hands.
Example
A minimal custody log for a USB stick image, with the hash recomputed at each step (here a 1 MiB test image of zero bytes):
Item: USB-01 image usb01.dd
SHA-256: 30e14955ebf1352266dc2ff8067e68104607e750abb9d3b36582b8af909fcb58
2026-10-01 09:12 Acquired by J. Park (write blocker) - hash recorded
2026-10-01 11:40 J. Park -> evidence locker 3 (sealed bag 4471)
2026-10-03 14:05 Locker 3 -> A. Diaz for analysis - hash matches
Compute and re-check such hashes with the File Checksum Calculator.