There is a pattern in the cases where digital evidence falls: it almost never falls because of its content. It falls because of the path it traveled. The message may have been true, the file may have been authentic, the record may have shown exactly what the party alleged. But nobody can say who touched that material, when, with which tool, and with what assurance that nothing was altered. Without that documented history, what was evidence becomes an object of reasonable doubt. The name of that history is chain of custody.
The concept entered the Code of Criminal Procedure through Law 13,964/2019, in articles 158-A to 158-F of the CPP (Brazilian Code of Criminal Procedure): the traceable record of every trace, from recognition at the scene to disposal, passing through collection, packaging, transport, processing, and storage. The letter of the law speaks of criminal procedure, but the logic has migrated to every arena. Civil and labor judges, arbitrators, and regulatory authorities now ask the same question: how did this material get here?
The technical yardstick: ISO/IEC 27037
Before Brazilian law named the institute, technical practice already governed it. The ISO/IEC 27037 standard guides the four operations that decide the fate of a piece of digital evidence: identification, collection, acquisition, and preservation. From it derive the procedures any serious expert report documents: the forensic image, a complete bit-by-bit copy of the original media; the write blocker, which prevents any alteration during acquisition; and the hash value, the mathematical fingerprint that allows either party to verify, at any time, that the examined copy is identical to the original material.
The sister standards complete the cycle: ISO/IEC 27041 addresses assurance of the suitability of methods, 27042 covers analysis and interpretation, 27043 sets out investigation principles. Together they form the methodology the laboratory's site declares in each forensic practice area, and which the report must demonstrate case by case.
What the courts have been deciding
The STJ (Brazil's Superior Court of Justice) has applied the yardstick with growing rigor to digital evidence. Screenshots extracted directly from a seized device, without a forensic tool, without hash values, and without documentation of the extraction, were held inadmissible. A device that circulated without a seal and without a recorded identifier led to nullity. Access to the device before the forensic examination rendered the evidence worthless. The message of the decisions is a single one: content does not save the evidence whose journey nobody can reconstruct.
"Chain of custody is not notarial formality. It is the difference between the evidence that decides the case and the evidence the opposing party disposes of in a single brief."
How the laboratory materializes the chain
In forensic practice, the chain of custody is a sequence of documented gestures. Receipt of the material is photographed and described, with a numbered seal. Acquisition takes place with a write blocker and generates the forensic image, authenticated by a hash calculated on the spot and recorded in the report. Every examination runs on the copy; the original remains untouched, stored in a vault room with controlled access until the case concludes. Every interaction with the material has its author, date, time, and purpose noted. The delivery media is finalized as read-only. Any expert, including the opposing party's, can retrace the path and arrive at the same verification.
This design applies to the phone seized in an investigation, to the server in a corporate dispute, to the database in an unfair competition case. The arena changes; the method does not.
A scenario that keeps repeating
Two parties dispute a contract. The first files a screenshot of an app conversation, photographed from their own phone's screen. The second commissions a forensic extraction of the device, with a recognized tool, calculated hash, and acquisition report. In the confrontation, the extraction demonstrates that the conversation in the screenshot had messages suppressed and the order altered. The screenshot was not fake in the vulgar sense: the messages existed. But the edited sequence changed the meaning of the agreement, and only the evidence with documented custody had the authority to demonstrate it. The case, common in the laboratory's routine, sums up the hierarchy: between two versions of the same fact, the one that can prove its own journey prevails.
Custody beyond the courtroom
The discipline was born in criminal procedure, but the fastest-growing arenas lie outside it. In arbitration, the arbitral tribunal evaluates technical evidence with the same yardstick, and the party that presents unsupported evidence loses credibility before arbitrators accustomed to sophisticated disputes. In internal compliance investigations, an inquiry that intends to sustain termination for cause or notification to authorities must be born with custody, because it will be challenged later. In cyber insurance claims, the insurer's audit examines how the incident evidence was preserved before authorizing payment. And under ANPD enforcement, the company that demonstrates it preserved and examined the incident with method negotiates from a different position. The investment is the same; the return shows up at four different tables.
What to check in a expert report (yours or the adverse one)
For the attorney, the chain of custody is a double-edged instrument. In building one's own case, it is a requirement: material collected without method in the first hours is rarely recoverable later. In examining the adverse report, it is the first line of attack. Questions that expose the weakness:
- Which tool performed the acquisition, in which version, and where is that declared?
- What hash value was calculated at the source and how was it verified during the examination?
- Who handled the material, when, and where is the record of those interactions?
- Did the examination run on a forensic copy or on the original itself?
- Was there a seal, a record of identifiers, and documented storage between collection and examination?
A report that cannot answer these questions with documents is usually a report that does not have the answers. And article 479 of the CPC (Brazilian Code of Civil Procedure) reminds us that the judge is not bound by the expert report: the judge only needs technical grounds not to follow it. The expert opinion that demonstrates the break in the chain of custody is, very often, exactly those grounds.
The conclusion is less legal than it seems: chain of custody is a discipline of the first hours. When suspicion arises, what is done before the forensic expert is engaged defines what will remain to prove later. Preserve first, examine later, document always.
