Legal E-Discovery · · 3 min read
How to Maintain Defensible Chain of Custody When Transporting Physical E-Discovery Servers
Direct Answer
Start with a device inventory and a handling plan approved by counsel. Use numbered tamper seals, keep custody accountable throughout the journey, and reconcile the equipment at delivery. Federal Rule of Evidence 901 requires support for authenticity, not a particular courier. A single custodian and a factual witness affidavit can help, but neither guarantees admissibility.
Talk to counsel before booking transport
Under Federal Rule of Evidence 901, there must be enough evidence to support a finding that an item is what its proponent claims. That becomes harder when nobody can explain a custody gap, identify the hardware, or account for who had access.
Using a common carrier does not automatically disqualify the evidence. The practical question is whether its hub transfers and subcontracted handling leave a record that counsel can use.
- Have counsel identify litigation holds, protective orders, and preservation obligations.
- Document hardware serial numbers, condition, power state, and authorized handlers.
- Do not power down, image, access, or modify a server without the approved forensic handling plan.
Maintain continuous, accountable custody
Keeping one custodian with the equipment reduces handovers where the journey allows it. Record that person's identity, release and receipt times, enclosure numbers, route changes, and any temporary change of control.
Screening or another lawful process may require an enclosure to be opened or separated from its escort. Record what happened. Do not describe physical possession as uninterrupted if it was not.
Use serial seals and forensic records together
Photograph the uniquely numbered seals on approved access points or enclosures, then check those same seals at delivery. Record any handling incident or environmental concern.
If authorized forensic images are created, retain their cryptographic hashes and acquisition records separately. A seal can help show whether an enclosure was opened. It cannot establish that the server's electronic contents remained unchanged.
An affidavit should describe what the witness actually saw
Where appropriate and lawfully available, a licensed Private Investigator who handled the transport can give a sworn account of custody transfers, seal checks, and exceptions. Confirm jurisdictional licensing and counsel's requirements before engagement.
The account should stay within the investigator's personal knowledge. A license does not establish authenticity by itself, and an affidavit cannot replace necessary testimony or the court's decision on admissibility.
- Retain signed handovers, contemporaneous logs, and original photographs.
- Distinguish personal observations from information supplied by other people.
- Have counsel review the evidence package and any declaration or affidavit.
Frequently Asked Questions
Does Rule 901 require a licensed Private Investigator to transport servers?
No. Rule 901 sets an authentication standard and gives examples of supporting evidence. It does not prescribe a courier license or require a single transport model. Counsel should choose controls appropriate to the evidence and jurisdiction.
Can a common carrier automatically invalidate chain of custody?
Carrier choice alone does not determine admissibility. Problems arise when transfers go undocumented, the hardware cannot be identified, or access cannot be explained. Detailed records and witnesses with direct knowledge help answer those questions.
Does a tamper seal prove that server data was unchanged?
A seal provides evidence about apparent physical access or interference. Establishing electronic integrity requires an appropriate forensic process, which may include authorized acquisition, hash verification, access controls, and preservation records.