Custody Evidence
Custody evidence is evidence of how a record was held, moved, protected, and controlled over time.
It helps explain what happened to the file, record, dataset, message, decision, source material, or supporting evidence after it was created, received, captured, exported, uploaded, preserved, or relied on.
Custody matters because a record does not remain strong simply because it exists. If nobody can explain where it has been, who had access to it, how it was protected, or whether it stayed connected to the right source material, the evidence position may weaken.
The purpose of this guide is to help users preserve custody context before a record is challenged.
Quick Read
- Custody evidence shows how a record was held, moved, protected, and controlled.
- It should preserve storage, access, transfer, handling, version, and preservation context where relevant.
- Custody evidence does not automatically prove truth, ownership, legality, authorship, or absence of alteration.
What this means
Custody evidence is the preservation layer of an evidence record.
It explains how evidence materials were kept and handled after they came into existence.
For a creator, custody may involve preserving original project files, drafts, exports, backups, and publication records. For a business, it may involve controlled folders, approval records, access permissions, audit logs, and document retention. For a research team, it may involve dataset storage, version control, lab records, contribution history, and access control. For an incident record, it may involve logs, exports, forensic copies, evidence notes, and investigation handling.
Custody evidence answers a practical question:
Can the record’s handling be explained well enough for someone else to trust that it is the right record, preserved in a responsible way?
Why it matters
Many evidence problems are not caused by the original record. They are caused by what happened after it was created.
Files are renamed. Folders are reorganised. Accounts are closed. Staff leave. Devices fail. Backups overwrite earlier versions. Cloud platforms change. Metadata is stripped. Drafts are deleted. Evidence is copied without notes. Records are moved between personal and business accounts. Source files are separated from receipts, screenshots, approvals, or context.
When custody is unclear, the record may become harder to rely on.
A person may have the right file but be unable to show that it is the same file. An organisation may hold important material but be unable to explain who accessed it. A team may preserve logs but lose the export context. A creator may keep a final work but lose the original project material.
Custody evidence reduces that risk.
What strong custody evidence should include
A stronger custody evidence position usually includes:
- The evidence material — the file, record, dataset, message, source material, export, receipt, approval, or supporting item being preserved.
- The custody claim — what is being said about how the evidence was held or protected.
- Storage context — where the material was stored, including device, account, repository, folder, archive, vault, or system.
- Access context — who could access, edit, move, delete, export, or approve the material.
- Transfer context — whether the material moved between systems, accounts, people, devices, operators, or organisations.
- Version context — how copies, exports, backups, drafts, or derivatives relate to the source material.
- Protection context — what controls, backups, permissions, retention rules, or preservation methods applied.
- Handling notes — any meaningful action taken with the evidence, including export, upload, sealing, review, transfer, or recovery.
- Audit context — logs or records showing relevant custody events where available.
- Recovery context — how the material can be found again.
- Claim boundaries — what the custody evidence supports and what it does not support.
The higher the value or dispute risk of the record, the more important custody becomes.
Common weak points
Custody evidence is usually weak when:
- the original or source material is missing
- only a final copy is preserved
- files have been moved, renamed, or exported without notes
- records are stored in personal accounts without organisational control
- access permissions are unclear
- shared folders are treated as controlled archives
- backups overwrite earlier versions
- metadata is lost during transfer or conversion
- there is no record of who handled the evidence
- source files are separated from supporting context
- receipts or proof records are stored separately from the underlying evidence
- the evidence cannot be recovered quickly
- the custody claim says more than the records support
These weaknesses are especially damaging when evidence is challenged months or years later.
How to apply this yourself
For each important record, create a custody note.
Ask:
- What evidence material is being preserved?
- Where is the original or source material stored?
- Who controls it?
- Who can access, edit, move, export, or delete it?
- Has it been copied, renamed, exported, uploaded, transferred, or converted?
- Are there multiple versions, and how do they relate?
- What controls protect the material?
- What records show handling, access, movement, or preservation?
- How can the evidence be recovered later?
- What custody claim cannot be supported?
Then keep the source material, custody note, and related supporting records together or clearly cross-referenced.
Do not treat ordinary storage as evidence custody unless it can be explained.
What this does not prove
Custody evidence does not automatically prove:
- ownership
- authorship
- copyright
- permission
- legality
- originality
- truth
- accuracy
- authenticity
- absence of alteration
- absence of dispute
- that the evidence has been independently verified
- that EviWrite has preserved or backed the record
Custody evidence helps explain how a record was handled and preserved. It does not decide every claim about the record.
Framework-aligned claim boundary
A person or organisation may use this guide as part of EviWrite Framework alignment if they apply the guidance honestly and avoid implying EviWrite involvement.
Acceptable wording may include:
“We use the EviWrite Framework to preserve custody evidence for important records.”
It must not be used to imply:
- EviWrite has preserved the evidence
- EviWrite has verified the custody chain
- EviWrite has approved the handling process
- the record is EviWrite-backed
- the record is EviWrite-certified
- the record carries the controlled ⓔ mark
- EviWrite has endorsed the organisation’s custody controls
Framework-aligned means public guidance was followed.
EviWrite-backed means the record was created through EviWrite or an authorised evidencing channel.
Related checklist
Use the Custody Evidence Checklist to check whether storage, access, movement, handling, preservation, recovery, and custody-claim boundaries have been preserved clearly.