Chain of custody and evidence

For executors, lawyers, trustees and technical specialists: evidence preservation is part of administering a crypto estate properly, it can matter in disputes, audits and court. When questions later arise about the origin or handling of devices and data, the estate should be able to show what was found and who dealt with it.

What chain of custody is

Chain of custody is the documented life of an item: where and when it was found, who found it, who subsequently handled, kept, copied or transferred it. In a crypto estate this concerns devices (computers, phones, hardware wallets, external drives), paper notes, backups and files that may point to wallets or accounts.

Even a simple record adds value: date, place, finder, the condition in which the item was found, and what was done with it afterwards.

When it matters

Whenever the origin, handling or integrity of a device, file or document may be questioned: multiple heirs, a disputed will, insurer or tax authority involvement, or any later disagreement about what was found and who handled it. It also becomes necessary when technical examination is later required, because a modified original can determine what remains feasible.

The record fields

For every item: what it is, where it was found, who found it, when, who handled it afterwards (each handover), what was done to it (nothing, or exactly what), and where it now is. Basic who-what-when records are better than none.

The five categories

1. Original media, the device or drive as found.
2. Working copies, made for examination, clearly labelled.
3. Backups, copies made for safety, kept separately.
4. Extracted data, files or records pulled out, with method and hash where relevant.
5. Secret access material, seed phrases, keys, passwords. Never written into any log. Their existence may be noted; their content never.

Practical rules

• Never reset, wipe or update original media before it is documented.
• Never write secrets into the chain-of-custody log or any document.
• Record every action, including “no action taken”.
• Keep the log and the items under the control of the authorised representative.
• Work on copies rather than experimenting on the original, where that is technically sound.
• Keep the circle small: note who has had access to sensitive material and when.
• Preserve packaging, a hardware-wallet box can matter for identification.

Evidence log and handling register

Two documents are common in a well-run estate:

• an evidence log, an overview of found items with date, location, finder and description;
• a handling register, who handled, copied, transferred or returned each item, and when.

Boundary

Chain of custody is evidence practice, not criminal forensics. Where law enforcement is involved, their procedures govern, and this record supports, rather than replaces, the estate’s administration. It is about administering the estate carefully and verifiably, not about tracing anonymous parties or finding stolen crypto.