# What is chain of custody for digital evidence?

Chain of custody is the written record of who collected a piece of evidence, when and how, and who has had it since. For a disk image, a log export or a network capture it means noting the source, the date and time, the method or tool used, a hash value that proves the copy has not changed, where it is stored and every person who accessed it. Without that record, a court, an insurer or a regulator may doubt that the evidence is what you say it is. A small company can keep it simply: one sheet per item, copies on write-once or access-controlled storage, and no work on the originals. NetSenX keeps an audit log of alerts, analyst decisions and configuration changes, and from the Starter plan a proof trail, which supports this record for the network side of an incident.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-is-chain-of-custody-for-digital-evidence

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we preserve logs before they are overwritten?](https://netsenx.com/en/faq/how-to-preserve-logs-before-they-are-overwritten)
- [What does eradication mean in incident response?](https://netsenx.com/en/faq/what-does-eradication-mean-in-incident-response)
- [How do we reset passwords safely after a breach?](https://netsenx.com/en/faq/how-to-reset-passwords-safely-after-a-breach)
- [How do we know the attacker is really gone?](https://netsenx.com/en/faq/how-do-we-know-the-attacker-is-really-gone)
- [Can we keep using our computers after a ransomware attack?](https://netsenx.com/en/faq/can-we-keep-using-computers-after-ransomware)