What is chain of custody for digital evidence?
Chain of custody is the written record of who collected a piece of evidence, when and how, and who has had it since. For a disk image, a log export or a network capture it means noting the source, the date and time, the method or tool used, a hash value that proves the copy has not changed, where it is stored and every person who accessed it. Without that record, a court, an insurer or a regulator may doubt that the evidence is what you say it is. A small company can keep it simply: one sheet per item, copies on write-once or access-controlled storage, and no work on the originals. NetSenX keeps an audit log of alerts, analyst decisions and configuration changes, and from the Starter plan a proof trail, which supports this record for the network side of an incident.