Chain of Custody (Cell Phone Forensics)

A chain of custody is the written record of who had an evidence item, when they had it, where it was stored, and why it was handled. In cell phone forensics, it also helps document practical preservation steps (like the phone’s lock state, AFU/BFU status, airplane mode, and Faraday isolation) that can impact what evidence is later available. For broader workflow context, see our cell phone forensics overview.

Educational resource Court-friendly documentation Template you can customize

Why it matters

Chain of custody is often challenged when phone evidence is used in litigation, family law, workplace disputes, insurance matters, or criminal defense. A complete log helps reduce arguments that the phone was mishandled, accessed by unknown parties, or altered.

Shows continuity of control (possession over time)
Documents storage conditions and access restrictions
Captures device-specific context (lock state, AFU/BFU, connectivity isolation)
Supports credibility when an examiner testifies or writes a report

How it’s used later in court

In hearings, depositions, or trial, chain of custody helps establish a foundation for the device and any extracted data by showing a documented handling history. It is commonly referenced to answer practical questions like:

When was the phone collected and by whom?
Was it isolated from networks (airplane/Faraday) to reduce remote wipe risk?
Who accessed or moved it, and for what purpose?
Were there any gaps, unclear handoffs, or undocumented handling?

Complete an entry every time evidence is handled

The key rule: if custody changes or the evidence is accessed, document it. For phones, also document any change that can affect data (unlocking, connecting to power, removing from Faraday, network changes, SIM/eSIM changes).

Transfer of custody

Date/time (include time zone)
Released by / received by
Purpose (e.g., intake, review, transport)
Signatures/initials

Access or opening

Reason for access (power/charge/unlock)
Lock state + AFU/BFU noted before/after
Airplane mode / connectivity status noted
Faraday removed/resealed (if applicable)

Storage movement

From location / to location
Storage method (locker/safe/cabinet)
Who placed it / who can access it
Seal/label/Faraday status updated

Practical tip: “No undocumented touches.” If someone unlocks it, charges it, removes it from a Faraday bag, or changes network state, add an entry.

Common chain of custody fields (cell phone evidence)

A well-designed phone custody form captures enough detail to identify the device, document preservation steps, and track custody changes clearly—without relying on memory later.

Case + evidence identifiers

Case name / case number
Evidence item ID (unique ID per device)
Collected by (name, agency/company, contact)
Collection date/time + location

Device specifics

Make/model, color, storage size
IMEI (and IMEI2 if present)
Serial number, EID (eSIM), ICCID (SIM)
Phone number (if known) and carrier (if known)

State + preservation

Power state (on/off/unknown), battery %
Lock state (locked/unlocked) + screen status
AFU/BFU (if known/observed)
Airplane mode status + Wi-Fi/Bluetooth/cellular status

Custody log (repeatable row)

Date/time of transfer or access (include time zone)
Released by / received by (printed name + signature)
Reason/purpose
Location + Faraday/seal status (intact/broken/resealed)

If accessories are collected (charger, SIM tray, SD card, case), list them explicitly and assign separate evidence IDs if your policy requires it.

Free Chain of Custody Download

Download a sample chain of custody form in .DOCX format designed for cell phone forensic matters. This template includes fields for IMEI, lock state, AFU/BFU, airplane mode, Faraday isolation, and more. You can edit the fields, add your letterhead, and adjust wording to match your internal policy and matter type.

Download Free Chain of Custody Form Learn more about Cell Phone Forensics

Sample-form disclaimer: this template is for educational and documentation purposes only. Requirements vary by jurisdiction, court expectations, and organizational policy. This content is not legal advice.

Mini checklist (what makes a phone chain of custody defensible)

Device is uniquely identified (IMEI/serial) and clearly described.
Every custody change is documented with date/time and purpose.
Network isolation steps are recorded (airplane/Faraday) when used.
Storage location is specific (safe/cabinet/locker), not vague.

Any unlocking/access is logged (who, where, why, before/after state).
Condition notes are recorded (damage, water exposure, cracked screen).
Seals/Faraday bag status is consistent and documented.
No gaps: if it was handled, it was logged.

For a broader explanation of cell phone forensic process (intake, preservation, extraction, analysis, and reporting), see our cell phone forensics overview.