Overview
Chain of custody is the documented trail that records the handling of evidence from the moment it is collected to its presentation in court. FrameCounsel automates much of this process for digital video evidence, creating a tamper-evident audit trail that satisfies court admissibility requirements.
SHA-256 Hashing
Every file imported into FrameCounsel is hashed using the SHA-256 algorithm. This hash serves as a digital fingerprint:
- The hash is computed at the moment of import and stored in the case audit log.
- Any modification to the file — even a single byte — produces a completely different hash.
- You can re-verify a file's integrity at any time by clicking Verify Hash in the Evidence Panel context menu.
The Audit Log
FrameCounsel maintains a comprehensive audit log for every case. The log records:
- File imports: When, from where, file size, and SHA-256 hash
- Analysis runs: What analysis was performed, when, and by whom
- Transcript edits: Original and modified text, timestamp, and user
- Exports: What was exported, in what format, and when
- Access events: When the case was opened or closed
The audit log is stored in a signed, append-only format. Entries cannot be modified or deleted.
Tip: Export the audit log as a PDF when preparing evidence for court. The formatted log shows a clear chain of custody with timestamps and hash values that can be independently verified.
Exporting the Chain of Custody
To generate a formal chain-of-custody document:
- Open the case and go to File > Export > Chain of Custody Report.
- Choose the evidence items to include (or select all).
- The report is generated as a PDF with tables showing each item's hash, import date, source path, and all handling events.
Multi-User Cases
If multiple people access the same case (e.g., an attorney and a paralegal), FrameCounsel records each user's actions separately in the audit log. User identification is based on the macOS user account.
Best Practices
- Import evidence as early as possible to establish the initial hash baseline.
- Avoid renaming or moving files outside of FrameCounsel after import.
- Regularly verify hashes, especially before court dates.
- Export and print the chain-of-custody report as a backup.
Warning: If a hash verification fails, it means the file has been modified since import. This could indicate corruption, accidental modification, or tampering. Document the discrepancy immediately and investigate the cause.