Short answer: Chain of custody for digital evidence means you can show, for every file, who created it, when and where, everyone who has accessed or handled it since, and that its content has not changed. For inspection media that requires capture-time binding, immutable storage, access logging, and export tracking — recorded automatically, because manual logs fail.
The five links
- Creation. The file was produced by a real camera in a real session, with a trusted timestamp and location. Screenshots and uploads from a gallery break this link immediately.
- Integrity. A cryptographic hash is computed at ingest and stored separately. Any later byte change is detectable. Content credentials extend this with a signed history.
- Storage. The original is written once and never overwritten. Annotations, redactions, and exports create derivatives; the source stays untouched.
- Access. Every view, download, export, and share is logged with user identity and time. See audit trail.
- Disposition. Retention and deletion follow a stated policy, and deletion is itself logged.
Where inspection programs break it
| Practice | Which link it breaks |
|---|---|
| Photos emailed as attachments | Access — no log of who forwarded to whom |
| Images edited in place to add arrows | Integrity — original no longer exists |
| Screenshots of a video call | Creation — no verifiable origin |
| Files in a shared drive folder | Storage and access — anyone can replace a file silently |
| Ad-hoc retention | Disposition — nothing defensible to state under discovery |
Making it automatic
Chain of custody survives only when it is a property of the system, not a discipline asked of busy people. Practically: capture inside the session so creation is bound; hash at ingest; store originals immutably; make annotation a layer; make sharing produce a tracked link rather than an attachment (see secure sharing); and generate the custody record as part of the report rather than on request.
What a custody report should show
One page per asset, or one table per case: file identifier and hash, capture time and location, capturing user and session, verification state, then a chronological list of access and export events with user and timestamp. If someone asks "prove this photo is what you say it is", that page is the answer.
Regulated contexts
Insurance disputes, construction defect litigation, warranty adjudication, and permit appeals all eventually test the record. Security posture matters here too — access control, encryption, and independent attestation. See SOC 2 Type II, AES-256 encryption, and admissibility.
Why manual custody logs fail
Paper and spreadsheet custody logs share the same three failure modes, and every one of them shows up under scrutiny rather than during normal operation.
- They are written after the fact. A log completed at the end of the week records what someone remembers, not what happened.
- They are editable. A spreadsheet with no version history proves nothing about itself, let alone about the files it describes.
- They cover the wrong boundary. Most logs start at upload. The interesting question — where did this file come from before it reached your system — is exactly the part they skip.
Automatic capture-time recording fixes all three at once, because the log is a by-product of doing the work rather than a separate task someone has to remember.
A custody record that holds up
For each media item, a defensible record answers six questions without anyone having to reconstruct them:
| Question | Recorded by | Failure if missing |
|---|---|---|
| Who captured it? | Session participant identity | Authorship is disputable |
| When? | Server timestamp, not the device clock | Timeline can be challenged |
| Where? | Device position plus accuracy radius | Site cannot be tied to the file |
| From what? | Live camera in-session, not a gallery upload | Origin unknown; recycled photos possible |
| Changed since? | Ingest hash plus signed edit history | Tampering undetectable |
| Seen by whom? | Access and export log | Leaks and edits untraceable |
The handling stage everyone forgets: export
Custody does not end when the report is generated. The moment a PDF is emailed or a share link is forwarded, the file is in circulation. A complete record therefore logs the export itself — who generated it, what it contained, and to whom the link was issued — and keeps share links revocable and time-limited rather than permanent. Where a recipient re-shares, the link, not the file, is the thing you can still control.
Virtual Inspection Pro records originals immutably, keeps annotations as a separate layer so the untouched frame always exists, and writes every view, download, and export into the audit trail. Reports carry the verification state visibly, so a recipient sees provenance without needing access to the platform.
Retention: keeping evidence is a liability too
Custody and retention pull in opposite directions. Evidence needs to survive long enough to defend a decision; personal data should not be kept longer than necessary. Resolve it with a written schedule rather than by default:
- Set retention per record type — a permit inspection, a warranty claim, and a support call rarely need the same clock.
- Apply a legal hold that suspends deletion for anything in dispute.
- Log the deletion event itself, so the absence of a file is explained rather than suspicious.
- Align the schedule with your obligations under GDPR and CCPA and with the controls described on the SOC 2 page.
A five-minute self-audit
Pick one closed job from three months ago and try to answer, from the system alone and without phoning anyone: who took photo four, at what time by whose clock, at what location, whether the copy in the report matches the original, who has downloaded it, and whether any share link is still live. Anything you cannot answer is a broken link in the chain — and the ones that break first are almost always origin and export.
FAQ
Is a chain of custody legally required?
It is rarely mandated for routine inspections, but it is what determines whether your evidence carries weight when challenged.
How long should media be retained?
Match the longest applicable limitation or regulatory period for your industry, and state it in policy. See retention.
Can annotated images be used as evidence?
Yes, provided the unmodified original is preserved and producible alongside them.
What does chain of custody mean for digital photos?
It means an unbroken, documented account of a file from creation to presentation: who made it, when and where, what has happened to it, and who has handled it since.
Are phone photos admissible as evidence?
They can be, but admissibility turns on authentication — can you show the image is what you say it is. Session-bound capture, server-side time, hashing, and complete access logs make that far easier than a bare file from someone''s camera roll.
Do I need C2PA to have a chain of custody?
No, but it strengthens the weakest link. Hashing proves nothing changed after upload; content credentials speak to what happened before it.
How long should inspection evidence be retained?
Long enough to cover the dispute, warranty, or statutory window that applies to the work, and no longer. Write it down per record type and enforce it automatically.
Who should be able to delete inspection media?
Ideally nobody, during the retention window. Use role-based permissions, suspend deletion under legal hold, and log any deletion that does occur.
Keep reading
- C2PA content credentials — signed provenance for field photos.
- GPS-verified photo capture — what location proof can and cannot show.
- Photo fraud in insurance claims — where recycled images get caught.
- Virtual property inspections for underwriting — evidence carriers accept.
- AI-generated inspection reports — narrative on top of verified evidence.