r/dfir

Hi,

What's the gold standard for recording chain of custody events? I'm trying to find a reasonable and a defensible method of logging CoC without under- or overengineering a solution. Currently I've settled on a "append only" on database level with a hash chain, exportable JSON and PDF reports and an independent verification script.

Would this be enough for a court in, say, the United States? I'm in Europe and this is something that rarely gets challenged in court, but the software I'm developing (https://dfire.fi/, a case management platform) is an international solution and I'd like the approach to be robust enough to stand international challenges.

This is what it produces now, and there's a script that calculates the hashes so an investigator can export the JSON and receipt and come back to prove that the chain is intact.

Would this be defensible in court globally?

Example receipt

And the JSON that's exportable looks like this:

{
  "schema": "dfire.custody.chain_export.v1",
  "exported_at": "2026-08-10T05:23:40.942577+00:00",
  "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
  "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
  "item_name": "Joe's Hard Drive",
  "case_number": "CASE-2026-001",
  "genesis_hash": "cde4524a6dffa46d0f3b016b07674e5c7a654303ca4897314f3e1a662b290cd7",
  "head_hash": "1aa1bb2f625c752d01684475ecee39c5fce3a707c6030adc7320c532d9cf9b5d",
  "entry_count": 3,
  "verification_status": "verified",
  "entries": [
    {
      "canonical_entry": {
        "condition": "Unknown condition, no visible defects",
        "from_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "PERSON",
          "display_name": "Joe Smith"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "DFIR Lab",
        "notes": "From Eddie's desktop computer",
        "previous_hash": "cde4524a6dffa46d0f3b016b07674e5c7a654303ca4897314f3e1a662b290cd7",
        "purpose": "Initial intake, confiscation record #332945023",
        "recorded_at": "2026-08-10T05:20:28.785270Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "1",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "transfer_datetime": "2026-08-10T05:19:00.000000Z",
        "transfer_type": "intake"
      },
      "entry_hash": "4c403157b4154dfc26ae25028282966322180a8d449729f84828a16ad71172b0",
      "hash_version": 1
    },
    {
      "canonical_entry": {
        "condition": "Physically intact",
        "from_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "Jane's Lab",
        "notes": "Delivered to Jane for imaging",
        "previous_hash": "4c403157b4154dfc26ae25028282966322180a8d449729f84828a16ad71172b0",
        "purpose": "Imaging the device",
        "recorded_at": "2026-08-10T05:21:57.752375Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "2",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "TEAM",
          "display_name": "Jane Forensicator"
        },
        "transfer_datetime": "2026-08-10T12:40:00.000000Z",
        "transfer_type": "transfer"
      },
      "entry_hash": "9ca8eb4bf2e8de16ebf39711a257a537c20c9379251675a7183ea047335c5c5e",
      "hash_version": 1
    },
    {
      "canonical_entry": {
        "condition": "Working, imaged successfully",
        "from_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "TEAM",
          "display_name": "Jane Forensicator"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "DFIR safe",
        "notes": "Image taken, image and hard drive delivered to Eddie, image attached as child evidence item.",
        "previous_hash": "9ca8eb4bf2e8de16ebf39711a257a537c20c9379251675a7183ea047335c5c5e",
        "purpose": "Imaged, returned for safekeeping",
        "recorded_at": "2026-08-10T05:23:15.854838Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "3",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "transfer_datetime": "2026-08-11T10:30:00.000000Z",
        "transfer_type": "transfer"
      },
      "entry_hash": "1aa1bb2f625c752d01684475ecee39c5fce3a707c6030adc7320c532d9cf9b5d",
      "hash_version": 1
    }
  ]
}