You collect a backdoored vendor installer from an infected host — what must each chain-of-custody entry record?
answer
- who had it, when, and why it moved
- two names and two signatures per move
- a unique item id, not 'the USB'
- written at the moment, not at case close
- possession, not integrity of contents
basics
~20 sEach entry names the item by a unique identifier, the date and time of the move, who released it, who received it, why it moved and where it went, signed by both parties. The point is that the item is never unaccounted for.
solid answer
~50 sA chain-of-custody record is a continuous, contemporaneous log of who held the item from collection onward. Every transition gets an entry: collection, going into storage, coming out for examination, transfer to another team or another organisation, and destruction. Each entry carries six things — the item's unique identifier (`EV-04`, not "the USB stick"), the date, time and timezone, the person releasing it by name, the person receiving it by name, the reason for the move, and the destination or storage location — with a signature from both sides, plus the seal number and whether the seal was intact if the item is bagged. Entries are written at the moment of the move, not reconstructed at case close. Internal moves count: a walk from the analyst's desk to a locked cabinet is a handoff. The record attests continuity of possession — not that the bytes are unchanged, and not that the item is malicious.
go deeper
Be ready to list what one entry contains — item id, date and time, who released it, who received it, why, where — and to say that both sides sign it at the moment of the move.
Explain why contemporaneous and append-only matter, how corrections are struck rather than erased, and why an internal desk-to-cabinet move still needs an entry.
Show the judgment: state precisely what the record attests (possession) versus what integrity verification attests, and describe how you would run this in a case where material is going to an outside firm.
Own the tradeoff between a procedure people actually follow and one that is theoretically complete. Be ready to say which cases trigger the full record and what the organisation accepts below that line.
## What the record is A chain of custody is a continuous, contemporaneous account of who had a piece of evidence, from the moment it was collected until it is produced, returned or destroyed. It is not a summary written when the case closes. It is a running log in which every change of hands or location is one dated, signed line. In a supply-chain intrusion — a vendor-signed software update that carried a backdoor — the material that matters is physical and awkward: the malicious installer copied off an infected workstation, an image of that workstation, and later the vendor's own copy of the same build. All three are likely to leave your building: to an outside incident-response firm, to counsel, possibly to the vendor's own responders. The custody record is the only thing that lets the receiving side treat your copy as the item you say it is. ## What each entry contains 1. **The item, by unique identifier.** An identifier assigned at collection and physically marked on the container: `EV-04 — one 32 GB USB drive, serial ABC123, holding the installer copied from FIN-WS-021`. "The USB stick" is not an identifier; in a case with four drives it is a defect. 2. **Date, time and timezone** of the transition. Mixed local times across a multi-site case are a standing source of apparent contradiction. 3. **Who released it** — full name and role, not initials nobody can resolve a year later. 4. **Who received it** — same. 5. **Why it moved** — analysis, transport, storage, return to the owner, destruction. 6. **Where it went** — the destination, or the storage location it entered. Both parties sign. If the item travels in a sealed container, the entry also records the **seal number** and its state (intact or broken) at the moment of transfer, and a new seal number when it is re-sealed. ## Contemporaneous, and append-only in effect The value of the record is that it was written when the thing happened. An entry created three days later from memory is a reconstruction, and the other side will read it as one. Corrections follow the same rule: you strike the error so it stays legible, initial and date the strike, and add a corrected entry. You never erase, overwrite or retype a page. A record that has been tidied looks curated, and a curated record invites the question of what else was tidied. ## Internal moves count The most common failure in a small team is logging the first collection and nothing after it, on the reasoning that the item never left the building. Continuity has no exemption for short trips. The disk that spent a weekend in someone's desk drawer is exactly the period the other side will ask about. Log the move to the cabinet, the removal for examination, the return. ## What it proves — and what it does not A custody record establishes **continuity of possession**: at every moment between collection and now, a named person or a controlled location was accountable for the item. That is all it establishes. - It does **not** show that the contents are unchanged. Integrity verification is a separate control applied at acquisition. - It does **not** show that the item is malicious, or relevant, or that anything on it is attributable to an adversary. Analysis does that. - It does **not** cure an unlawful or out-of-scope collection. Getting this boundary right matters in interviews, because the common wrong answer — "the custody log proves the file wasn't modified" — collapses two different controls into one and leaves the candidate unable to say what either is for. ## Where the record lives A paper form travelling with the sealed container, a bound notebook, or a case system — the medium matters far less than three properties: entries are attributable to a named person, they cannot be silently altered after the fact, and they exist at the time of the event. A shared spreadsheet anyone can edit without trace satisfies none of these; a paper form in the bag satisfies all three. ## Who eventually reads it An examiner at the outside IR firm deciding whether to accept your material at all. Counsel deciding what can be asserted. An insurer, a regulator, an arbitration with the vendor whose update carried the backdoor, or an employment process if the subject turns out to be a person rather than a supplier. And, immediately and unglamorously, your own team — the record is what stops a second analyst examining a copy someone already modified while believing it is the original.
- The installer never left the building. Do you still log the move from the analyst's desk into the evidence cabinet?Yes. Continuity has no short-trip exemption, and internal gaps are the ones that actually appear in real cases — the drive that sat in a drawer over a weekend with no entry. Log the removal, the return, and who held it in between. The internal moves are also the ones your own team relies on to know which copy is which.
- What does a chain-of-custody record prove, and what does it not?It proves continuity of possession: a named person or controlled location was accountable at every moment. It does not prove the contents are unaltered — that is integrity verification done at acquisition, a separate control — and it says nothing about whether the item is malicious, relevant, or lawfully obtained. Candidates who merge these two controls usually cannot explain either.
- You wrote the wrong time on an entry. How do you fix it?Strike the error so it remains readable, initial and date the strike, then write a new entry with the correct value and the reason for the correction. Do not erase, overwrite or retype the page. A visible correction reads as an honest mistake; a clean rewritten record reads as one someone curated.
The custody record is the item's passport. Every border it crosses gets a stamp with a name, a time and a reason. A missing stamp does not prove the item went somewhere bad — it means nobody can say where it was, and that is enough for the other side to work with.
saying these in an interview costs you the question
- Says the custody log proves the file was not modified
- Logs the first collection and none of the later handoffs
- Records 'the USB stick' with no unique item identifier
- Writes up the whole record from memory at case close
- Erases or retypes an entry instead of striking a correction
- Treats custody as paperwork only lawyers care about