Chain of custody is a term referring to continuity of evidence, also sometimes called continuity of possession. Custody refers to the legal right of a person to posses, handle or transport evidence at a particular time. In a legal process, it is necessary to be able to monitor changes that happen from the time of gathering evidence at the scene until evidence is produced at court.

Any weakness in the Journal of Evidence may indicate that a piece of evidence was misused, tampered or altered. A piece of evidence presented in the courtroom is deemed identical to the evidence collected at the scene based on the statement of a person who collected the original piece of evidence, verifying that the original material is present in the courtroom at that time, and testifying that such material has not been tampered with nor the chain of custody has been broken.

It is obvious that preservation of evidence integrity correlates with the number of people who might temper with such evidence. The best practice is to appoint one person to be in charge of particular evidence.

However, in case of digital evidence, when analysis and processing of digital data is required, it is impossible to have such person present all the time during forensic analysis. In such cases, laboratory which examines the evidence will issue a confirmation at the time digital evidence is received, as well as at the time when results are delivered. In this way data integrity is preserved. Such processing of digital evidence necessitates testimony of respective forensic specialist or lab technician in court, about the manner in which digital evidence was stored and protected within laboratory that examined the evidence.