An outside IR firm's examiner finds a two-hour gap in your custody log for a seized installer — what now?

## What the gap actually is A hole in a custody record is a period during which no named person and no controlled location was accountable for the item. It is not proof that anything happened to the material. It is the absence of the evidence that nothing did — and the entire function of a custody record is to supply that evidence, so the absence is exactly the thing the other side will work with. In the case at hand, a two-hour period sits between the item being removed from the evidence cabinet and it reappearing in a second examiner's hands, with no releasing custodian, no receiving custodian and no signature. ## The reflex to refuse The instinctive fix is to work out who probably had it and write the line. Do not. A signed entry created after the fact and presented as contemporaneous converts a documentation failure into a credibility failure, and it puts the person who signed it personally in the frame. Once one entry in a record is shown to be reconstructed, every other entry is open to the same question, and you lose the whole record rather than one item. The same logic forbids re-printing the form "more neatly". ## What you do instead, in order **1. Disclose, in writing, immediately.** Tell the receiving examiner and counsel what the gap is, when it runs from and to, which item it affects, and what you know about it. A gap you volunteer is a limitation on your evidence. A gap the other side finds is an argument about your competence and your candour. **2. Reconstruct from sources you did not author.** The strongest reconstruction uses records whose timestamps you do not control: badge or door-access records for the room, the cabinet's electronic access log, the ticketing system's own timestamps, chat or mail traffic in which the person mentions having the item, and CCTV if it exists. Photographs of the sealed container help: if the seal number recorded at collection is the number photographed on reappearance and the seal is intact, that constrains what could have happened to the contents — but note the direction of the claim carefully. **An intact seal shows the container was not opened; it does not show who held it or where it was.** It narrows the doubt; it does not remove it. **3. Take a dated memo from the person involved,** written now, clearly labelled as a present recollection of past events, filed alongside the custody record and never inside it. That distinction — a memo about the gap versus an entry in the log — is the whole difference between honest reconstruction and fabrication. **4. Re-acquire under a clean chain where you can.** This is the move candidates most often miss and it is frequently the best available. In a supply-chain compromise the backdoored vendor installer is not a unique object: the same build sits on other infected hosts in your estate and at the vendor itself. Acquiring a fresh copy from a second host, under a properly kept chain, gives you an item you can rest a claim on. Keep the gapped item, record that it exists and why you are not relying on it, and document the substitution openly — quietly swapping one for the other is the failure mode this whole exercise is meant to prevent. **5. Scope what the item can still do.** A gapped artefact is not worthless. It can still steer the investigation entirely legitimately: derive behavioural detections from it, sweep the estate for the same activity, tell the vendor what to look for. What it should not do is carry a contested claim on its own — the sole basis for asserting that a specific person or a specific supplier did a specific thing — if a better-custodied item can carry it instead. **6. The receiving examiner decides.** They may accept the item with the gap noted as a limitation, accept it for some purposes and not others, or decline it. That is their judgment about material they will have to stand behind. Arguing them out of it is a poor use of the relationship; giving them everything they need to make the call is the job. ## Then fix the cause, not the symptom A gap of this shape is almost always structural rather than personal: a cabinet with several keyholders, a custody form kept in an office rather than with the item, a rule that the entry is written on return rather than before the move. Change those. The specific corrective that removes this class of gap is writing the entry **before** the item moves rather than after, and having a single named custodian per item rather than a team with shared access. ## The wrong answers to avoid Destroying or discarding the item because it is "tainted" is worse than the gap — you have now disposed of evidence in a matter under investigation, which is a materially more serious problem than a documentation hole. Concealing the gap and hoping the outside firm does not check is the failure this whole discipline exists to make impossible. And treating it as pure paperwork with no consequence for what you can claim misses that the consequence is precisely a narrowing of what that one artefact will support.