Digital Evidence Chain of Custody in South Africa

Start with an identifiable item

Assign a case and item identifier. Record the device or media, condition, date and time of receipt, source, relevant accessories and packaging. Keep personal information limited to what the matter requires.

Record each transfer and examination

For each custody event, identify the person releasing and receiving the item, time, purpose, location and condition. Record changes to packaging or seals and any exceptions. Do not reconstruct missing events as though they were observed.

Distinguish original material and working copies

Describe how a file, image or export was acquired. Record integrity values where applicable and identify analysis copies. A hash comparison demonstrates whether the compared bytes match; it does not independently establish the original author's identity or whether collection was lawful.

Document tools and limitations

Record relevant versions, settings, timestamps and time-zone assumptions. Explain unavailable logs, partial extractions, encrypted material or actions that changed the device. A report should make another qualified examiner able to understand what was done.

Understand the South African evidence position

Section 15 of the Electronic Communications and Transactions Act addresses electronic evidence and its weight. Relevant considerations include reliability of generation, storage and communication, preservation of integrity and identification of the originator.

The legal requirements for a particular dispute extend beyond a custody form. Qualified partners can review process and provide relevant sign-off, but a court decides admissibility and weight. Obtain legal advice for a specific matter.

Request an evidence-focused intake

Tell ZA Support at the start if the matter may involve a court, insurer, employer dispute or criminal complaint. That allows preservation and reporting requirements to be agreed before repair or remediation changes the evidence.

Further reading

• Electronic Communications and Transactions Act, section 15
• NIST mobile-device forensics