Chain of Custody Calculator
Score the completeness of an evidence custody record — documentation, signatures, hash verification and unexplained gaps.
Inputs
Chain of Custody Score
70.6%
Transfers Documented
87.5%
Transfers Countersigned
75.0%
Transfers Hash-Verified
62.5%
Penalty for Timeline Gaps
6.0points
Weakest Link
Hash verification on receipt — the strongest available proof and the most often skipped
Admissibility Risk
High risk — expect the evidence to be challenged on handling
Step by step
Values used
Custody transfers in the record = 8 transfers; Transfers with a complete written record = 7 transfers; Transfers signed by both parties = 6 transfers; Transfers with a hash verified on receipt = 5 transfers; Total unexplained time in the timeline = 3 hours; Time in tamper-evident sealed storage = 90 %; Timestamp source = NTP-synchronised system clocks with recorded offset
Chain of Custody
Custody score = (0.35 × hash-verified% + 0.3 × documented% + 0.2 × countersigned% + 0.15 × sealed-storage% − gap penalty) × timestamp factor.
Timeline gap penalty
Gap penalty = unexplained hours × 2, capped at 30 points.
Chain of Custody Score
= 70.6
Transfers Documented
= 87.5
Transfers Countersigned
= 75.0
Transfers Hash-Verified
= 62.5
Penalty for Timeline Gaps
= 6.0 points
Weakest Link
= Hash verification on receipt — the strongest available proof and the most often skipped
How it works
Hash verification carries the heaviest weight because it is the only factor that proves the bytes did not change, rather than merely documenting who held the media. Unexplained time is penalised directly, since a gap in the timeline is precisely the opening a defence expert needs. Technically perfect forensics is worthless if the custody record cannot survive cross-examination, and custody is lost through mundane omissions — an unsigned handover, a laptop left in a car, a receipt hash never checked.
Formulas
Chain of Custody
Custody score = (0.35 × hash-verified% + 0.3 × documented% + 0.2 × countersigned% + 0.15 × sealed-storage% − gap penalty) × timestamp factor.
- hash-verified%
- Transfers where the digest was checked on receipt
- gap penalty
- 2 points per unexplained hour, capped at 30
- timestamp factor
- 1.0 NTP-synchronised, 0.9 unverified system clocks, 0.75 manual times
Timeline gap penalty
Gap penalty = unexplained hours × 2, capped at 30 points.
- unexplained hours
- Time the record cannot account for the evidence's location and custodian
Frequently Asked Questions
How is Chain of Custody calculated?
Custody score = (0.35 × hash-verified% + 0.3 × documented% + 0.2 × countersigned% + 0.15 × sealed-storage% − gap penalty) × timestamp factor. Hash verification carries the heaviest weight because it is the only factor that proves the bytes did not change, rather than merely documenting who held the media. Unexplained time is penalised directly, since a gap in the timeline is precisely the opening a defence expert needs.
Why does Chain of Custody matter?
Technically perfect forensics is worthless if the custody record cannot survive cross-examination, and custody is lost through mundane omissions — an unsigned handover, a laptop left in a car, a receipt hash never checked.
What values do I need to enter?
This calculator takes 7 inputs: Custody transfers in the record, Transfers with a complete written record, Transfers signed by both parties, Transfers with a hash verified on receipt, Total unexplained time in the timeline, Time in tamper-evident sealed storage, Timestamp source. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does a small gap really matter?
It matters more than most responders expect. Any period where the record cannot say who held the evidence and where it was stored invites the argument that it could have been altered. Document even the boring intervals: locked in safe X, sole key holder Y.
What must a transfer record contain?
Who released it, who received it, exact date and time with the clock source, the item identifier, the hash verified on receipt, the reason for transfer, and both signatures. Anything missing is an avenue of challenge.