An exhibit may pass through clients, attorneys, vendors, witnesses, court reporters, and trial teams before it reaches a judge or jury. Each transfer creates a risk that the item will be misplaced, altered, mislabeled, or separated from its supporting records.
A chain of custody for legal exhibits documents where evidence came from, who handled it, what was done to it, and how it was protected. This record can support authentication, answer claims of alteration, and help the trial team locate the correct version for a deposition, hearing, or trial.
The process should begin during collection. A defensible system connects preservation, electronic discovery, exhibit marking, storage, transfer, and courtroom presentation.
What Does Chain of Custody Establish?
Chain of custody is a record of possession, control, transfer, processing, and storage. It helps show that an exhibit is the same item collected from its source and that it remained protected from unauthorized changes.
Federal Rule of Evidence 901 requires the party offering an item to produce enough evidence to support a finding that the item is what the party claims it is. A witness with personal knowledge may authenticate an item, but the rule permits other methods. The proper foundation depends on the evidence and why it is being offered.
Detailed custody records are most useful when an exhibit can be altered, substituted, contaminated, or challenged based on its source, highlighting the importance of a proper chain of custody. Examples include physical objects, mobile-device data, surveillance video, social media records, audio files, database exports, medical images, and cloud documents. A gap does not always require exclusion, but it gives opposing counsel more room to question authenticity and reliability.
Start the Record During Collection
The first entry should identify the evidence as it existed when collected. The record should state who collected it, where it was found, when it was collected, and how it was obtained. For a physical item, the collector should also document its condition, packaging, identifying marks, and storage location.
The item should receive a unique internal identifier that remains connected to it even if it later receives a production number, deposition exhibit number, or trial exhibit number. One item may acquire several labels during the case, but each label should trace back to the original record.
Photographs can document physical evidence before packaging or transfer. For client-provided documents, note whether the material was an original, photocopy, scan, screenshot, forwarded email, or exported file.
What Should an Exhibit Log Include?
The amount of information depends on the exhibit and the case. A useful log commonly includes:
A unique evidence or exhibit identifier
A short description of the item
The date, time, and location of collection for establishing a chain of custody for each item of evidence
The name and role of the person who collected or received it
The source, custodian, device, account, or storage location
The condition and format of the item at collection
Each transfer date and the identities of the sender and recipient
The reason for each transfer
Any copying, scanning, extraction, conversion, or testing performed
Hash values or other digital identifiers when used
Production, deposition, and trial exhibit numbers
Current storage location and access restrictions
Each entry should be made when the event occurs. Reconstructing a transfer weeks later from memory, calendars, and email creates uncertainty regarding the chain of custody of the evidence. The log should also distinguish between physical possession and access to an electronic copy.
Exhibit Marking Does Not Replace Authentication
An exhibit sticker or electronic stamp identifies an item within a deposition, hearing, or trial. It does not prove where the item came from or whether it changed before it was marked.
Litigation teams should maintain a link between the original evidence identifier and every later exhibit number. The same document may appear as a production document, deposition exhibit, motion attachment, and trial exhibit. A cross-reference table can connect those versions and reduce the risk of using an incomplete or outdated copy.
Before a deposition, counsel should decide whether exhibits will be pre-marked or marked as introduced. The court reporter should receive the numbering instructions, case caption, and exhibit-handling protocol. In multi-party litigation, a shared numbering system can prevent different attorneys from assigning the same number to unrelated documents.
The final electronic file presented to the witness should be retained in the form used during testimony. If counsel displays selected pages, highlights text, or applies temporary annotations, the record should identify which version became the marked exhibit. Afterward, the exhibit list should be compared with the transcript and files received from the reporter to verify the chain of custody for each item of evidence.
Electronically Stored Information Requires More Documentation
Electronically stored information (ESI) creates added concerns because several copies may exist at once, and each version may contain different metadata, attachments, embedded content, or revision history.
According to Federal Rule of Civil Procedure 26, a party must include in its discovery plan how it will preserve and produce electronically stored information, including the method of production. These discussions should happen early enough to identify relevant systems, custodians, data sources, and any automatic deletion practices.
A collection record should identify the custodian, source system, device, account, folder, collection date, collection method, and person who performed the work. It should also state whether the data was collected through a forensic image, application export, remote collection, or selected file copy.
The collection method should fit the evidence. A screenshot may omit metadata, hidden content, hyperlinks, prior versions, and information outside the captured image. A native file preserves more information but should be stored and reviewed without changing its content or metadata. Preserve an unaltered source copy and work from controlled duplicates when possible. Any changes made during processing, review, redaction, or production should be documented.
Hash Values Can Identify Digital Copies
A hash value is a digital identifier created by applying an algorithm to a file or data set. Even a small content change generally produces a different result. Comparing hash values can help show that a copied file matches the version collected earlier.
Secure Hash Algorithm 256-bit (SHA-256) is one method used for this purpose. The collection log should record the algorithm, resulting value, date generated, tool used, and person or system that performed the process.
Federal Rule of Evidence 902(14) permits certain copied electronic data to be authenticated through a digital identification process supported by a qualifying certification. Rule 902(13) provides a certification procedure for records generated by an electronic process or system that produces an accurate result. Both require advance notice and access to the record and certification so the opposing party can challenge them.
A matching hash value does not establish who created the file, whether its contents are true, or whether another evidence rule permits admission.
Production Records Should Connect Back to the Source
Under the guidelines set forth by the National Institute of Justice, establishing a chain of custody is crucial for all pieces of evidence. For example, Federal Rule of Civil Procedure 34 requests for documents, electronically stored information, and tangible items are permitted. A requesting party may specify the form of production. When no form is specified, electronically stored information generally must be produced as ordinarily maintained or in a reasonably usable form.
The production record should identify which source files were selected, how they were processed, what redactions were applied, and which files were delivered. Bates numbers should be mapped to native files, extracted text, metadata, and load files when those components are included.
An email and its attachments may be treated as one document family during review but receive separate production numbers. The record should preserve that relationship. A replacement production also should not overwrite an earlier version without documentation of what changed, why it changed, and when the other parties received notice.
Control Access and Transfers to Digital Evidence
Physical evidence should be stored in a restricted location, with each removal and return logged. Electronic evidence should use access controls that limit who may view, download, modify, or export data to prevent tampering with the item of evidence. The team should also confirm what the system records and how long audit logs are retained.
Outside vendors should receive written handling instructions. The record should identify the materials transferred, transfer method, recipient, requested work, and return or delivery date. This applies to forensic collection, scanning, court reporting, legal videography, trial presentation, and document hosting.
Preservation Failures Can Affect the Case
Chain-of-custody documentation cannot restore evidence that has been deleted, overwritten, discarded, or altered. Preservation procedures should begin when the duty to preserve arises under the governing law.
Federal Rule of Civil Procedure 37(e) applies when electronically stored information that should have been preserved for anticipated or pending litigation is lost because a party failed to take reasonable steps and the information cannot be restored or replaced through additional discovery. A court may order measures to address prejudice. More severe measures, including adverse presumptions, dismissal, or default judgment, require a finding that the party intended to deprive another party of the information’s use.
The rule calls for reasonable steps, not perfect preservation of every file. Documentation helps show which systems were reviewed, which custodians received instructions, what data was collected, and how later loss or system changes were handled.
Review the Exhibit Record Before Trial
Trial preparation should include a custody and authenticity review. The team should verify prior to being presented in court:
The source and collection history for each exhibit
The witness or certification needed for authentication
The connection between source files, production numbers, and exhibit numbers
Whether the offered version matches the version used in testimony
Whether redactions, highlights, or annotations changed the item
Whether electronic files retain required metadata and digital identifiers
Whether certification and advance-notice requirements have been met
Whether the exhibit list matches the courtroom presentation database
Whether confidential materials remain subject to a protective order or sealing procedure
Who will maintain custody during trial
The review should separate evidence offered for admission from demonstrative aids. The team should also confirm how exhibits will move between counsel table, the witness, the clerk, and the presentation operator.
Build a Defensible Exhibit Process with NAEGELI Deposition & Trial
A reliable chain of custody is a continuing record rather than a form completed at the end of the case. It begins with preservation and collection, follows each transfer and transformation, and connects the source item to the version offered in court.
NAEGELI Deposition & Trial provides nationwide client services for law firms. Coordinated support can help litigation teams maintain consistent exhibit numbering, delivery instructions, access controls, and courtroom presentation files.
Reach out to us to arrange support for your next chain of custody forms and exhibits by calling (800) 528-3335 or by emailing schedule@naegeliusa.com.
You can also click “SCHEDULE NOW” or live chat for litigation support services.