Chapter 9 — Custody

A prosecutor in Maryland wanted to show a jury that a defendant's girlfriend had threatened a witness. He had the evidence: printed pages from a MySpace profile under the name "Sistasouljah," containing the threat, alongside a photograph and a birth date matching her.

The Maryland Court of Appeals threw it out. The trial court, it held, had failed to acknowledge the possibility that another person could have created that profile or authored that posting. The pages were not properly authenticated. Conviction reversed, new trial ordered. [ESTABLISHED] (Griffin v. State, 419 Md. 343 (2011) — full opinion)

The court then did something unusually helpful: it specified what would have sufficed. Testimony from the person who created the profile. Forensic examination of that person's own computer. Or records obtained directly from the platform linking the account and the post to a specific individual.

That is the most citable precedent in this book for a sentence every investigator needs written on the inside of their skull:

A screenshot is not evidence. It is a picture of evidence.

Nothing in Part II changes this. A machine that reads a million messages and finds the one that matters has produced a lead. What makes that message admissible is entirely the boring apparatus described in this chapter, and if the apparatus is missing, the finding is worth nothing regardless of how correct it is.

What a chain of custody is for

The function is narrow and specific: to establish an unbroken, documented record of who possessed a piece of evidence at every point between seizure and court, so that contamination or tampering challenges can be foreclosed rather than argued about.

For digital material the requirement is stricter than for physical, for one reason: a file can be copied, modified or moved without leaving any visible trace. A tampered document looks exactly like an untampered one. The record is the only thing standing between the two. [ESTABLISHED] (practitioner analysis)

What breaks it, in practice: unlogged transfers between people, missing hash verification at handoff points, evidence copied or opened on a device without write protection, absent records of who accessed a file and when. Any one of these can be sufficient grounds for a court to exclude the evidence outright — independent of what the evidence would have shown. [ESTABLISHED]

Sit with that clause. Evidence can be scientifically flawless, factually correct, and decisive, and still be worth nothing because of a gap in a log. A conviction was reversed in 1971 over a chain break in a rape case; the principle has not softened since. [ESTABLISHED] (Case Western faculty publication)

Chapter 3 spent its length on which forensic disciplines are scientifically valid. This chapter's argument is that the question is downstream of a more basic one, and the more basic one is answered by paperwork.

The mechanics

Hashing. Compute a cryptographic hash of the evidence at acquisition, record it, and recompute at every handoff. If the values match, the material is bit-identical to what was seized. If they do not, you know precisely when it changed. This is the entire chain of custody compressed into one number, and it is the cheapest protection in the field.

Write blockers. Hardware or software devices that prevent write commands reaching the original media during imaging — the mechanism that lets an examiner assert the copy is identical to the source. The failure mode is stated by practitioners and worth repeating: a write blocker is only as trustworthy as its own validation. An uncertified, unvalidated blocker is not a guarantee; it is an additional unexamined link in the chain. [ESTABLISHED] (ElcomSoft)

The governing standards. NIST Special Publication 800-101 Revision 1 covers mobile device forensics — validation, preservation, acquisition, examination, analysis, reporting, including physical methods such as chip-off and JTAG. NIST SP 800-86 covers integrating forensic technique into incident response, in four stages.

An important scoping note that people get wrong: SP 800-86 is written for IT incident response, not for criminal evidence. Using it as a courtroom standard requires supplementing it with actual legal chain-of-custody practice. And Revision 1 of 800-101 supersedes an earlier document that covered only cell phones — a reminder that forensic guidance dates quickly as devices change. [ESTABLISHED] (SP 800-101r1; SP 800-86)

The tools are not magic, and their limits are the interesting part

Two commercial products dominate mobile extraction: Cellebrite's UFED and GrayKey. Both are usually discussed as though they open anything. Neither does.

GrayKey bypasses passcodes on locked devices and can extract keychain material on supported configurations. Its architecture is the point: it is vulnerability-dependent. It works by exploiting undisclosed flaws, and each Apple security update closes the specific hole in use — producing windows in which new iPhone models simply cannot be accessed until a new exploit is found. Court records document failures against updated iOS. [ESTABLISHED] (legal analysis of GrayKey effectiveness)

Cellebrite has broad device support across logical, physical and cloud extraction, and its effectiveness has likewise fallen against modern iOS through 2025–2026, with reported market mindshare declining year on year as encryption strengthened. [CONTESTED] — the market figures come from a comparison site rather than an audited source.

And the single most operationally useful fact about both: device state decides everything. A phone seized in the Before First Unlock state — powered off, never unlocked since boot — is dramatically harder to access than one in After First Unlock, where decryption keys are resident in memory. Powering a device off is described as a highly effective countermeasure. [ESTABLISHED]

That cuts both ways and you should hold both. It is why an arrest team wants the phone unlocked and in hand. It is also why a criminal who reboots his phone has substantially defeated a tool that cost a police force tens of thousands of dollars.

The precedent that never happened

In February 2016, the US Department of Justice obtained an order requiring Apple to build software that would bypass the security of an iPhone 5C used by one of the San Bernardino attackers. Apple refused, arguing that building such a capability was itself the harm.

The case is universally remembered as a landmark. It produced no law. On 30 March 2016 the FBI announced it had accessed the phone using a third-party tool — reportedly costing around a million dollars — and withdrew its request. No ruling was ever made on whether Apple could be compelled. The question remains open. [ESTABLISHED] (NPR)

This matters practically, not just historically. The legal position on compelled decryption assistance is unsettled in most jurisdictions, which means anyone planning an investigation around the assumption that a locked device will eventually be opened is planning around a hope.

What this means for a machine-assisted investigation

Everything in Part II operates on copies. This is the chapter that says what the copies must be.

A cluster of three hundred fraud complaints is a research finding. The three hundred complaints are the evidence, and each one must exist as an acquired, hashed, logged artefact whose provenance can be recited — or the cluster points at nothing you can use.

So the pipeline has an order, and it is not the order people naturally work in:

1. Acquire and hash before analysing. Not after, when you have found something interesting.
2. Analyse the copy, never the original, and record which copy.
3. Every machine output resolves to a hashed source artefact — the citation rule from Chapter 4,

now with the additional requirement that the cited document itself be preserved.

1. Log every transfer, including transfers into and out of any AI system, because that is a

custody event like any other and is the one nobody currently logs.

Point four is where current practice is weakest and where I expect the first serious challenge to machine-assisted investigation to land. When a defence lawyer asks which model version processed the evidence, what its inputs were, whether the material left the jurisdiction, and who could have altered it in transit, most organisations today have no answer. Building the log before anyone asks is cheap. Reconstructing it under cross-examination is impossible.

The Move — Hash at acquisition, always, before you look. The moment any material enters your possession, compute and record its cryptographic hash with the date, the source, and how it was obtained — before you read it, before you are interested in it, before you know whether it matters. Material becomes interesting after you have started working with it, and by then the acquisition record cannot be created honestly. This is a thirty-second habit that determines whether months of work is usable.

What would change my mind: if courts began routinely admitting machine-derived findings without requiring the underlying artefact and its provenance, the strictness argued here would be overengineering. The trend, as far as the record shows, runs the other way — Griffin is fifteen years old and authentication requirements for digital material have tightened since, not loosened.