Score the completeness of an evidence custody record — documentation, signatures, hash verification and unexplained gaps.
Hash verification carries the heaviest weight because it is the only factor that proves the bytes did not change, rather than merely documenting who held the media. Unexplained time is penalised directly, since a gap in the timeline is precisely the opening a defence expert needs. Technically perfect forensics is worthless if the custody record cannot survive cross-examination, and custody is lost through mundane omissions — an unsigned handover, a laptop left in a car, a receipt hash never checked.
Chain of Custody
Custody score = (0.35 × hash-verified% + 0.3 × documented% + 0.2 × countersigned% + 0.15 × sealed-storage% − gap penalty) × timestamp factor.
Timeline gap penalty
Gap penalty = unexplained hours × 2, capped at 30 points.
Custody score = (0.35 × hash-verified% + 0.3 × documented% + 0.2 × countersigned% + 0.15 × sealed-storage% − gap penalty) × timestamp factor. Hash verification carries the heaviest weight because it is the only factor that proves the bytes did not change, rather than merely documenting who held the media. Unexplained time is penalised directly, since a gap in the timeline is precisely the opening a defence expert needs.
Technically perfect forensics is worthless if the custody record cannot survive cross-examination, and custody is lost through mundane omissions — an unsigned handover, a laptop left in a car, a receipt hash never checked.
This calculator takes 7 inputs: Custody transfers in the record, Transfers with a complete written record, Transfers signed by both parties, Transfers with a hash verified on receipt, Total unexplained time in the timeline, Time in tamper-evident sealed storage, Timestamp source. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It matters more than most responders expect. Any period where the record cannot say who held the evidence and where it was stored invites the argument that it could have been altered. Document even the boring intervals: locked in safe X, sole key holder Y.
Who released it, who received it, exact date and time with the clock source, the item identifier, the hash verified on receipt, the reason for transfer, and both signatures. Anything missing is an avenue of challenge.