Chain of Custody Calculator
Score the completeness of an evidence custody record — documentation, signatures, hash verification and unexplained gaps.
About Chain of Custody Calculator
Hash verification carries the heaviest weight because it is the only factor that proves the bytes did not change, rather than merely documenting who held the media. Unexplained time is penalised directly, since a gap in the timeline is precisely the opening a defence expert needs. Technically perfect forensics is worthless if the custody record cannot survive cross-examination, and custody is lost through mundane omissions — an unsigned handover, a laptop left in a car, a receipt hash never checked.
Formulas
Chain of Custody
Custody score = (0.35 × hash-verified% + 0.3 × documented% + 0.2 × countersigned% + 0.15 × sealed-storage% − gap penalty) × timestamp factor.
- hash-verified%
- Transfers where the digest was checked on receipt
- gap penalty
- 2 points per unexplained hour, capped at 30
- timestamp factor
- 1.0 NTP-synchronised, 0.9 unverified system clocks, 0.75 manual times
Timeline gap penalty
Gap penalty = unexplained hours × 2, capped at 30 points.
- unexplained hours
- Time the record cannot account for the evidence's location and custodian
Worked example
With the default values below, Chain of Custody Calculator returns Chain of Custody Score of 70.6%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Custody transfers in the recordaccepts 1–500 transfers
- 8 transfers
- Transfers with a complete written recordaccepts 0–500 transfers
- 7 transfers
- Transfers signed by both partiesaccepts 0–500 transfers
- 6 transfers
- Transfers with a hash verified on receiptaccepts 0–500 transfers
- 5 transfers
- Total unexplained time in the timelineaccepts 0–10,000 hours
- 3 hours
- Time in tamper-evident sealed storageaccepts 0–100 %
- 90 %
- Timestamp sourceone of NTP-synchronised system clocks with recorded offset, System clocks, offset not recorded, Manually written times
- NTP-synchronised system clocks with recorded offset
Results
- Chain of Custody Score
- 70.6%
- Transfers Documented
- 87.5%
- Transfers Countersigned
- 75.0%
- Transfers Hash-Verified
- 62.5%
- Penalty for Timeline Gaps
- 6.0 points
- Weakest Link
- Hash verification on receipt — the strongest available proof and the most often skipped
- Admissibility Risk
- High risk — expect the evidence to be challenged on handling
Step by step
- 1Values used
- 2Chain of Custody
- 3Timeline gap penalty
- 4Chain of Custody Score= 70.6
- 5Transfers Documented= 87.5
- 6Transfers Countersigned= 75.0
- 7Transfers Hash-Verified= 62.5
- 8Penalty for Timeline Gaps= 6.0 points
- 9Weakest Link= Hash verification on receipt — the strongest available proof and the most often skipped
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Chain of Custody calculated?
Custody score = (0.35 × hash-verified% + 0.3 × documented% + 0.2 × countersigned% + 0.15 × sealed-storage% − gap penalty) × timestamp factor. Hash verification carries the heaviest weight because it is the only factor that proves the bytes did not change, rather than merely documenting who held the media. Unexplained time is penalised directly, since a gap in the timeline is precisely the opening a defence expert needs.
Why does Chain of Custody matter?
Technically perfect forensics is worthless if the custody record cannot survive cross-examination, and custody is lost through mundane omissions — an unsigned handover, a laptop left in a car, a receipt hash never checked.
What values do I need to enter?
This calculator takes 7 inputs: Custody transfers in the record, Transfers with a complete written record, Transfers signed by both parties, Transfers with a hash verified on receipt, Total unexplained time in the timeline, Time in tamper-evident sealed storage, Timestamp source. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does a small gap really matter?
It matters more than most responders expect. Any period where the record cannot say who held the evidence and where it was stored invites the argument that it could have been altered. Document even the boring intervals: locked in safe X, sole key holder Y.
What must a transfer record contain?
Who released it, who received it, exact date and time with the clock source, the item identifier, the hash verified on receipt, the reason for transfer, and both signatures. Anything missing is an avenue of challenge.