Malte ZanderContents
A chain of custody documents, without gaps, who captured each piece of digital evidence, when, how and with what, where it has been since and who has accessed it. A checksum such as SHA-256 proves that a file hasn't changed since it was captured. For fake websites, a lean log with five details per file is enough, provided you keep it consistently from the start.
- ISO/IEC 27037 is the international guideline for identifying, collecting, acquiring and preserving digital evidence (ISO).
- The Berkeley Protocol sets minimum standards for collecting, preserving and verifying online information (UC Berkeley).
- SHA-256 is specified in the US standard FIPS 180-4. Such digests are used to detect whether data has changed since they were computed (NIST).
What is a chain of custody?
The answer to the question of why anyone should trust a piece of digital evidence. A file can be copied, changed and saved again without it showing. The chain of custody closes that gap. For every piece of evidence, it shows the path from capture to handover: who created it, when, with what, where it was stored, who passed it on and that it wasn't changed along the way.
Why do you need one for fake websites?
Because the fake itself disappears. After a successful takedown, the page no longer exists. What remains are your screenshots, copies and data. If a law firm later sends a cease-and-desist letter, a court has to decide or the police investigate, those files must be credible. Without a chain of custody, any screenshot can be disputed. With one, you can show that it was created exactly like that on the stated day.
The five details per piece of evidence
For fake websites, a lean log is enough. For every file, record:
What: the file name and a short description, such as "desktop screenshot of the fake login".
From where: the full URL or source, such as the RDAP lookup for the domain.
When: date, time and time zone of the capture.
Who and with what: person, device, browser or tool.
Checksum: the file's SHA-256 value right after capture.
Add entries for every handover: to whom, when, through which channel, and the checksum the recipient confirms.
What is a checksum, in plain words?
A digital fingerprint. A method such as SHA-256 calculates a long string of characters from a file. If even a single bit of the file changes, you get a completely different string. If you record the checksum at capture, you can show later that the file is unchanged: you calculate the checksum again and compare. SHA-256 is specified in the FIPS 180-4 standard and available with built-in tools on all common systems (NIST).
A template for your log
This is what an entry can look like. Keep it as a table or a text file next to the evidence:
Case: [short case name, case number]
File: [file name], [description]
Source: [full URL or lookup]
Captured on: [date, time, time zone], by [name], with [device, browser or tool, version]
SHA-256: [checksum]
Storage: [location, access only for (people or role)]
Handovers: [date, to whom, through which channel, checksum confirmed yes or no]
Where and how do you store evidence?
So that nobody can change it unnoticed. What works: a separate storage location per case with restricted access, read-only originals and working copies for highlights or redactions. Never edit the original. Record who has access, and log every handover. For handing over to a law firm, The evidence package your law firm actually needs shows a proven structure.
Which mistakes break the chain?
Editing originals: a cropped or highlighted screenshot is no longer an original.
Checksum too late: a checksum calculated weeks later only proves the state from then on.
Forwarding instead of handing over: files that travel through messengers or as forwarded emails often lose metadata or get compressed.
Gaps in the log: one missing entry for a handover is enough to raise doubt.
Unclear times: without a time zone, a time can't be placed unambiguously.
How much effort is appropriate?
As much as the case is likely to need. For a simple takedown, good screenshots and data with timestamps are enough. As soon as a case might go to court, customers were harmed or an actor keeps reappearing, the full log with checksums pays off. Because you rarely know that at the time of the find, it's wise to keep it from the start: it can't be added later. Whether and how a chain of custody holds up in court is for your law firm to assess. This overview is not legal advice.
How does AI Fraud Protect help?
AI Fraud Protect captures screenshots, the full URL and registration, DNS, hosting and certificate data with timestamps for every find and keeps the evidence package with the case. Every report and answer is documented too, so each case's path stays traceable. A person reviews and sends every report.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Do I need specialist forensic software?
Not for most cases. A checksum tool, a protected storage location and a clean log are enough. Specialist software helps with high case volumes and complex proceedings.
How do I calculate a SHA-256 checksum?
With built-in tools: on Windows with Get-FileHash in PowerShell, on macOS and Linux with shasum or sha256sum in the terminal.
Does everyone who captures evidence have to be in the log?
Yes. Anyone who captures or hands over something belongs in the log. Keep the circle small.
Is a chain of custody enough for the authorities?
It's a good foundation. Authorities have their own requirements, which they'll tell you if needed.
Sources
UC Berkeley Human Rights Center: Berkeley Protocol on Digital Open Source Investigations
NIST: FIPS 180-4, Secure Hash Standard, August 2015