2025/29157 - Chain of Custody & Audit Trails

REQUEST

I am seeking information about the force's standard procedures for documenting chain of custody (CoC) and audit trails (AT) during the processing and analysis of audio and textual digital evidence.

The relevant teams are the digital forensics department and the investigation unit, or the equivalent within your force.

Please provide the following information (for CoC and AT separately where applicable):

1. Recording practices

Please describe the types of information that are routinely recorded in CoC and AT documentation

2. Methods and systems

Please describe the systems or processes used to record or track CoC and AT, and indicate whether these are manual, automated, or hybrid.

3. Verification procedures

Please indicate whether any procedures exist to verify that digital evidence is genuine and unmodified at the point of acquisition or during analysis.

4. Policies and guidance

Please provide copies of, or references to, any current policies, standard operating procedures, guidance documents, or templates governing CoC and AT for audio and textual digital evidence.

5. Responsibility for CoC and AT

Please indicate whether CoC and AT documentation is managed in-house or outsourced, and identify the relevant role(s), department(s), or external provider(s) responsible.

Search period:

Current versions of documents and procedures only (no historical search required).

Glossary

*           Audit Trail (AT): Refers to the documentation processes that capture, record, and report the sequence of actions applied to digital evidence. An AT may include details such as model configurations, parameters used, error rates, human interventions, and system-generated logs. It functions as a transparency mechanism, enabling the reconstruction and evaluation of how evidence has been processed, analysed, and interpreted.

*           Chain of Custody (CoC): This is the record of how evidence is handled from the point of collection through processing to presentation in court. This may include the identity of the person handling the evidence, date/time of transfer, storage details, and digital identifiers. Alternative terms include 'continuity', 'chain of evidence' and 'provenance'.

*           Audio evidence: This refers to recorded sound collected, preserved, and analysed for legal or investigative purposes. This includes, but not limited to,  audio from body-worn cameras, dashcams, police radio communications, emergency calls, and interview recordings.

*           Textual evidence: This refers to written content, stored or transmitted in digital form, collected, preserved, and analysed for legal or investigative purposes. It includes, but not limited to transcripts, emails, chat logs, and social media posts.

RESPONSE