Chain of custody documents who collected, handled, and transferred evidence — maintaining integrity for legal admissibility. Any gap = evidence may be inadmissible or challenged.
Document: what was collected, when, by whom, where stored, every transfer. Hash evidence immediately upon collection. Use tamper-evident storage. Handle original media with write blockers. In court: chain of custody proves evidence was not tampered with.