Chain of Custody in Forensic Science

Chain of custody in forensic science is the unbroken, documented record of every person who collected, transferred, stored, analyzed, or otherwise had access to a piece of physical evidence, from the moment it is recovered to its final disposition — return, destruction, or long-term retention. Its purpose is narrow and specific: to let a court, an accrediting body, or an auditor confirm that the evidence analyzed or presented is the same evidence originally collected, unaltered and unsubstituted. This is a distinct concept from the broader “sample chain of custody” used in academic and clinical research labs (see CASRAI’s guide to sample chain of custody in research labs for that adjacent but different use case) — forensic chain of custody exists to protect legal admissibility and evidentiary integrity, not primarily scientific reproducibility, though the two overlap in toxicology, forensic genetics, and any research context touching controlled substances or litigation.

This guide is written for lab managers, procurement officers, and forensic or toxicology laboratory directors evaluating chain-of-custody procedures, documentation systems, and the supplies or vendors that support them — not as a legal reference for attorneys.

What Establishes a Valid Chain of Custody

For evidence to be admissible, or for a forensic laboratory to satisfy its accreditation body, the custody record must be able to answer four questions at every single handoff: who had the item, when did they have it, what did they do with or to it, and what condition was it in when they received it and when they released it. A record with a gap in any of these — a missing signature, an unexplained time lapse, an unsealed container — creates a challengeable weak point. In U.S. federal courts this ties back to the general authentication requirement in the Federal Rules of Evidence (Rule 901: evidence must be authenticated by evidence sufficient to support a finding that the item is what its proponent claims); state evidence codes generally mirror this. Chain of custody is the operational mechanism labs use to be able to meet that bar.

Chain of Custody Procedure: The Core Steps

While specifics vary by discipline (a toxicology specimen, a DNA swab, and a digital device are handled differently), the chain of custody procedure follows the same structural pattern:

Collection. The item is recovered and immediately assigned a unique identifier (case number plus item/sub-item number). The collector records where, when, and how it was obtained.
Packaging and sealing. The item goes into tamper-evident packaging — a heat-sealed bag, evidence tape, or a numbered security seal — such that any attempt to open it before the intended next step is physically detectable.
Labeling. The container is marked with the case/item number, collector’s name, date/time, and a brief description, matching the collector’s contemporaneous notes.
Transfer. Every time custody moves — collector to transport, transport to lab intake, intake to analyst, analyst back to storage — the outgoing and incoming custodian both sign, date, and time-stamp the transfer, and the seal number is checked and logged.
Intake and storage. The receiving lab logs the item into its evidence-control or LIMS system and places it in access-controlled, and where relevant temperature-controlled, storage.
Analysis. The analyst records when the item was removed from storage, what was done to it, and when and how it was resealed and returned.
Final disposition. Return to the submitting agency or owner, scheduled destruction, or continued retention (common when appeals are possible) — each closed out with a final signed record.

What an Evidence Chain-of-Custody Record Must Document

A complete evidence chain-of-custody entry, at every transfer, should capture:

A unique, persistent item/case identifier that never changes across the item’s life
A description sufficiently specific to distinguish the item from any other (not just “one bag” but item type, quantity, distinguishing marks)
The releasing custodian’s printed name and signature
The receiving custodian’s printed name and signature
Date and time of the transfer (many labs require minute-level precision, not just date)
The purpose of the transfer (analysis, storage, court presentation, return)
Condition of the item and its seal on receipt, and any discrepancy noted immediately
The seal or tamper-evidence number applied at each repackaging step
Storage location, including any temperature log for biological or toxicology specimens

The paper or digital form that captures all of this is often simply called the chain-of-custody (CoC) form; in federally regulated drug-testing programs it has a specific, standardized version — the Federal Custody and Control Form used for SAMHSA-regulated workplace testing (see CASRAI’s guide to SAMHSA-certified laboratories for how that program’s chain-of-custody requirements interact with laboratory certification).

Chain of Custody Example

Illustrative example only — a simplified composite for explanatory purposes, not a record of any real case.

A blood sample is collected from a subject at a hospital by a phlebotomist trained in forensic collection. It is sealed in a tamper-evident kit, labeled with a case number, and signed over to a courier at 14:05. The courier signs the form again on delivery to the toxicology lab’s intake desk at 15:40, where the intake technician verifies the seal is intact, logs the sample into the LIMS, and places it in refrigerated evidence storage. Two days later, an analyst signs the sample out of storage at 09:12, performs the requested testing, reseals the remaining specimen with a new numbered seal, records the old and new seal numbers, and returns it to storage at 11:30. When testimony is later required, the lab produces the full signed chain — collector, courier, intake technician, analyst — with no unexplained gap in custody or time.

Procurement: What to Evaluate When Buying Chain-of-Custody Supplies and Systems

For a lab manager or procurement officer, chain of custody is not just a documentation practice — it is also a purchasing decision, spanning physical supplies, tracking software, and sometimes an outside accredited lab. Evaluate on these dimensions rather than price alone:

Tamper-evident packaging. Evidence bags, tape, and seals should be uniquely numbered, show clear and irreversible evidence of any attempt to open them (void indicators, destructible adhesive), and be compatible with the specimen types the lab actually handles (liquid-tight for biological/toxicology specimens, static-safe for digital media).
Chain-of-custody forms and tracking software. Whether paper or digital, the system needs to force capture of every field above at every transfer — not leave it optional — and, for digital systems, produce an audit trail that cannot be edited after the fact without leaving a visible record of the edit. Check whether it integrates with the lab’s existing LIMS or requires duplicate manual entry, which is itself a common source of gaps.
Barcode or RFID compatibility. Scannable identifiers reduce transcription error at each handoff and speed intake; confirm the labeling supplies and the tracking software use a compatible barcode symbology and scanner hardware.
Secure, access-logged storage. Evidence lockers, refrigerators, and freezers used for chain-of-custody items should log every access (who, when) independently of the CoC paperwork, and — for biological or toxicology specimens — maintain and log temperature within validated ranges.
Retention and export capability. Records may need to be produced years later for an appeal or a reaccreditation audit; confirm the system’s data retention period and export format meet the lab’s own retention policy and any applicable regulatory requirement.
Accreditation of any outside lab you send evidence to. If chain-of-custody items are ever transferred to a third-party forensic laboratory rather than analyzed in-house, that lab’s own accreditation is a direct proxy for whether it will maintain custody discipline. The relevant benchmark for a forensic testing laboratory is ISO/IEC 17025 accreditation with forensic scope, most commonly issued in the U.S. through ANAB (which absorbed the former ASCLD/LAB forensic accreditation program) or A2LA. For forensic toxicology specifically, individual analyst certification and a narrower lab-accreditation track are also offered by ABFT — see CASRAI’s comparison of forensic lab accreditation vs. ABFT certification for how those two credentialing paths differ and what each one actually verifies.

Common Chain-of-Custody Failure Points

Most chain-of-custody challenges do not come from anything dramatic — they come from ordinary process gaps that a procurement or documentation decision can close:

A transfer with no signature, or a signature with no legible printed name
Time gaps between when an item was removed from storage and when analysis is logged as having started
Packaging that does not clearly show whether it was opened (reused bags, non-tamper-evident tape)
Item descriptions that drift slightly between entries (different quantity, different container description)
Digital tracking systems that allow silent edits to a past entry rather than an appended correction
Storage areas without independent access logging, so the CoC paperwork is the only record of who could have reached the item

Frequently Asked Questions

What is the chain of custody procedure in forensic science?

It is the sequence of collection, tamper-evident packaging, labeling, signed transfer at every handoff, controlled storage, analysis, and final disposition, with a documented record at each step showing who had the evidence, when, and in what condition.

What is evidence chain of custody?

Evidence chain of custody is the documented history of possession and handling for a specific piece of physical evidence — the record itself, as distinct from the physical evidence-handling procedure that produces it. A gap in that record is what defense counsel or an accreditation auditor will look for first.

What is an example of chain of custody?

See the illustrative example above: a specimen moving from collector to courier to lab intake to analyst and back to storage, with a signed, timed entry at every transfer and no unexplained gap.

Who is responsible for maintaining chain of custody?

Every individual who takes possession of the item, even briefly, is responsible for their own segment of the record. Overall responsibility for the lab’s chain-of-custody system — forms, training, storage security, and audit — typically sits with the laboratory’s quality manager or evidence custodian.

How long must chain-of-custody records be retained?

Retention periods vary by jurisdiction, case type (criminal appeals can extend retention well beyond a case’s initial disposition), and any accreditation body’s own record-retention requirement. Confirm the specific period against the applicable jurisdiction’s rules and the lab’s accreditation body rather than assuming a single default.

Does chain of custody in forensic science differ from chain of custody in a research lab?

Yes. Forensic chain of custody exists primarily to support legal admissibility. Research sample chain of custody exists primarily to protect scientific and regulatory integrity — reproducibility, sponsor agreements, controlled-substance accounting — and typically does not need to anticipate courtroom challenge. See CASRAI’s sample chain of custody in research labs guide for the research-lab version of this same underlying discipline.

Chain of Custody in Forensic Science: Procedure, Documentation, and Procurement

Ask about Chain of Custody in Forensic Science: Procedure, Documentation, and Procurement