u/SubstantialEditor995

Hi,

Some background: I've worked in cyber security incident response related jobs for nearly 15 years - as a DFIR team lead, a SecOps manager, NCSC-FI Duty Officer and Cyber Crime Investigator for the Helsinki PD.

I built DFIRe (https://dfire.fi) because no option combined the features that I would want from a platform - effortless case management, strong reporting with guided templates, and a user interface that gets out of your way when you need to focus on incident handling. It's priced mid-tier so significantly less than the competing alternatives, and there's no seat or feature limitations or tiered pricing.

DFIRe has a 90 day free trial with no credit card requirement or anything like that, it's self-hosted via Docker with full data sovereignity, and it's under active continuous development.

There's a free license key offer for eligible individuals and organizations, if you're interested you can check it out here: https://dfire.fi/free-license

Hi,

What's the gold standard for recording chain of custody events? I'm trying to find a reasonable and a defensible method of logging CoC without under- or overengineering a solution. Currently I've settled on a "append only" on database level with a hash chain, exportable JSON and PDF reports and an independent verification script.

Would this be enough for a court in, say, the United States? I'm in Europe and this is something that rarely gets challenged in court, but the software I'm developing (https://dfire.fi/, a case management platform) is an international solution and I'd like the approach to be robust enough to stand international challenges.

This is what it produces now, and there's a script that calculates the hashes so an investigator can export the JSON and receipt and come back to prove that the chain is intact.

Would this be defensible in court globally?

Example receipt

And the JSON that's exportable looks like this:

{
  "schema": "dfire.custody.chain_export.v1",
  "exported_at": "2026-08-10T05:23:40.942577+00:00",
  "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
  "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
  "item_name": "Joe's Hard Drive",
  "case_number": "CASE-2026-001",
  "genesis_hash": "cde4524a6dffa46d0f3b016b07674e5c7a654303ca4897314f3e1a662b290cd7",
  "head_hash": "1aa1bb2f625c752d01684475ecee39c5fce3a707c6030adc7320c532d9cf9b5d",
  "entry_count": 3,
  "verification_status": "verified",
  "entries": [
    {
      "canonical_entry": {
        "condition": "Unknown condition, no visible defects",
        "from_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "PERSON",
          "display_name": "Joe Smith"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "DFIR Lab",
        "notes": "From Eddie's desktop computer",
        "previous_hash": "cde4524a6dffa46d0f3b016b07674e5c7a654303ca4897314f3e1a662b290cd7",
        "purpose": "Initial intake, confiscation record #332945023",
        "recorded_at": "2026-08-10T05:20:28.785270Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "1",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "transfer_datetime": "2026-08-10T05:19:00.000000Z",
        "transfer_type": "intake"
      },
      "entry_hash": "4c403157b4154dfc26ae25028282966322180a8d449729f84828a16ad71172b0",
      "hash_version": 1
    },
    {
      "canonical_entry": {
        "condition": "Physically intact",
        "from_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "Jane's Lab",
        "notes": "Delivered to Jane for imaging",
        "previous_hash": "4c403157b4154dfc26ae25028282966322180a8d449729f84828a16ad71172b0",
        "purpose": "Imaging the device",
        "recorded_at": "2026-08-10T05:21:57.752375Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "2",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "TEAM",
          "display_name": "Jane Forensicator"
        },
        "transfer_datetime": "2026-08-10T12:40:00.000000Z",
        "transfer_type": "transfer"
      },
      "entry_hash": "9ca8eb4bf2e8de16ebf39711a257a537c20c9379251675a7183ea047335c5c5e",
      "hash_version": 1
    },
    {
      "canonical_entry": {
        "condition": "Working, imaged successfully",
        "from_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "TEAM",
          "display_name": "Jane Forensicator"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "DFIR safe",
        "notes": "Image taken, image and hard drive delivered to Eddie, image attached as child evidence item.",
        "previous_hash": "9ca8eb4bf2e8de16ebf39711a257a537c20c9379251675a7183ea047335c5c5e",
        "purpose": "Imaged, returned for safekeeping",
        "recorded_at": "2026-08-10T05:23:15.854838Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "3",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "transfer_datetime": "2026-08-11T10:30:00.000000Z",
        "transfer_type": "transfer"
      },
      "entry_hash": "1aa1bb2f625c752d01684475ecee39c5fce3a707c6030adc7320c532d9cf9b5d",
      "hash_version": 1
    }
  ]
}