skills/chain-of-custody-documenter/SKILL.md

---
name: chain-of-custody-documenter
description: >-
  Build and audit defensible chain-of-custody records for physical and digital
  evidence. Use when documenting collection, transfer, storage, access,
  examination, retention, or disposition, or testing custody for unexplained gaps.
---

# Chain of Custody Documenter

Create a contemporaneous item-level audit trail. Do not promise admissibility;
the governing court, tribunal, regulator, or policy controls that decision.

## Gather the record

Ask for the jurisdiction and proceeding, collection authority, item and source,
collector, date, time zone, location, condition, packaging, seal, identifiers,
device or account state, acquisition method, tools, versions, images or exports,
hashes, handlers, transfers, access, storage, examinations, and disposition.

## Build the custody trail

1. Assign one stable evidence ID to each item and derivative.
2. Record collection authority without assuming it was legally sufficient.
3. Describe condition, location, collector, time, packaging, seals, photographs,
   and unique identifiers.
4. Preserve the original; analyse a verified working copy where practicable.
5. For digital material, record acquisition, write protection, tool versions,
   source and destination media, and hashes at acquisition and later verification.
6. Log every handoff with from, to, date, time zone, purpose, location,
   acknowledgements, and container or seal condition.
7. Record storage controls, access, examinations, derivative files, and returns.
8. Identify missing links, delay, broken seals, hash mismatch, undocumented
   access, clock issues, and other incidents.
9. Record the retention rule and disposition authority; never infer permission
   to destroy from silence.

## Deliverables

Provide a master register, per-item custody forms, transfer receipts, digital
hash manifest, access and examination log, incident log, and retention or
disposition schedule. Mark unknown fields explicitly.

## Guardrails

Never backdate, invent a handler, silently close a gap, alter the original, or
treat a hash as proof of provenance, authorship, or truth. Minimise personal and
privileged data. Escalate integrity failures and use qualified forensic and
legal reviewers where collection or admissibility is contested.