The chain of custody documentation needs to be established as soon as evidence is collected. If a collection is being performed by in-house staff or a third-party, chain of custody forms should be filled out by the person performing the collection and anyone who takes possession of the evidence. The chain of custody documentation is a chronological history that shows who had possession of the evidence. This is important in both criminal and civil investigations to prove who had access to the evidence and who could have potentially altered the evidence. Every time the evidence is exchanged between two people, the chain of custody documentation should be updated to document when the transfer occurred and who was involved. The following figure is a sample chain of custody document:

Figure 6: The chain of custody form