Chain of custody and evidence

For executors, lawyers, trustees and technical specialists: evidence preservation can be part of administering a crypto estate properly and can matter in disputes, audits and court. A chain-of-custody log is a practical method for recording who handled material and what actions were taken. It is not a universal legal requirement, but it may be legally required or expected in some procedures; the formal requirements depend on the procedure and the jurisdiction. When questions later arise about the origin or handling of devices and data, the estate can show what was found and who dealt with it.

What chain of custody is

Chain of custody is the documented life of an item: where and when it was found, who found it, who subsequently handled, kept, copied or transferred it. In a crypto estate this concerns devices (computers, phones, hardware wallets, external drives), paper notes, backups and files that may point to wallets or accounts.

Even a simple record adds value: date, place, finder, the condition in which the item was found, and what was done with it afterwards.

When it matters

Whenever the origin, handling or integrity of a device, file or document may be questioned: multiple heirs, a disputed will, insurer or tax authority involvement, or any later disagreement about what was found and who handled it. It also becomes necessary when technical examination is later required, because a modified original can determine what remains feasible.

The record fields

For every item: what it is, where it was found, who found it, when, who handled it afterwards (each handover), what was done to it (nothing, or exactly what), and where it now is. Basic who-what-when records are better than none.

The five categories

1. Original media, the device or drive as found.
2. Working copies, made for examination, clearly labelled.
3. Backups, copies made for safety, kept separately.
4. Extracted data, files or records pulled out, with method and hash where relevant.
5. Secret access material, seed phrases, keys, passwords. Never written into any log. Their existence may be noted; their content never.

Practical rules

• Never reset, wipe or update original media before it is documented.
• Never copy seed phrases, private keys or passwords into the chain-of-custody log or other administrative documents. Note only that the access material exists and where it is kept securely.
• Record every action, including “no action taken”.
• Keep the log and the items under the control of the person or persons authorised for the management and the relevant actions.
• Work on copies rather than experimenting on the original, where that is technically sound.
• Keep the circle small: note who has had access to sensitive material and when.
• Preserve packaging, a hardware-wallet box can matter for identification.

Evidence log and handling register

Two documents are common in a well-run estate:

• an evidence log, an overview of found items with date, location, finder and description;
• a handling register, who handled, copied, transferred or returned each item, and when.

Boundary

Chain of custody is evidence practice, not criminal forensics. Where law enforcement is involved, their procedures govern, and this record supports, rather than replaces, the estate’s administration. It is about administering the estate carefully and verifiably, not about tracing anonymous parties or finding stolen crypto.