Chain of custody and audit trail 1255/2025

FOI Reference: 1255/2025

Request

I am seeking information on what is captured and logged in chain of custody (CoC) and audit trails (AT) during the analysis of digital evidence. To support consistent interpretation, the terms used in this request are defined in the glossary below.

Relevant Unit: The relevant team for this request is the digital forensics department.

Search Period: I am interested in current practice within your force as at the date of your response to this request.

1. Is a Chain of Custody (CoC) and Audit Trail (AT) recorded when digital evidence is processed and analysed?

If yes, please provide the following information (for CoC and AT separately where applicable):

i. Details of the information that is recorded as part of the CoC and AT.

ii. Details of any technical or procedural methods used to record or track the CoC and AT. Kindly specify if the process is automated, manual, or hybrid.

iii. Has your force conducted any internal evaluations or comparisons regarding the efficiency, accuracy or reliability of automated, manual, or hybrid reporting methods?

If yes, please provide copies or references.

iv. Please indicate whether any verification or validation procedures are in place to confirm that digital evidence, upon acquisition, is a genuine and unmodified record rather than a synthetically generated or manipulated.

v. Any guidelines, practice directions, or policies guiding the documentation of CoC and AT for digital evidence, including any templates or forms. Kindly attach or reference related documents.

vi. Is the maintenance of a CoC and AT managed in-house or outsourced? Please provide details of the responsible role(s).

Glossary

* Audit Trail (AT): Refers to the documentation processes that capture, record, and report the sequence of actions applied to digital evidence. It functions as a transparency mechanism, enabling the reconstruction and evaluation of how evidence has been processed, analysed, and interpreted.

* Chain of Custody (CoC): This is the record of how evidence is handled from the point of collection through processing to presentation in court. This may include the identity of the person handling the evidence, date/time of transfer, storage details, and digital identifiers. Alternative terms include 'continuity', 'chain of evidence' and 'provenance'.

Response Q1

I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below:-

Yes it is captured

Response Q(i)

I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below:-

All movements into the DFU are captured within a records management system. Any movement within the DFU is typically recorded in contemporaneous notes. Each step of an examination is recorded manually.

Response Q(ii)

I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below:-

It is a manual process within contemporaneous notes.

Response Q(iii)

I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below:-

Yes potentially moving to an automated solution within a case management system in the future.

Response Q(iv)

I can confirm that Dyfed-Powys Police does hold the information requested.

Yes hash values are verified of the captured data from computer devices. Also tools are validated to ensure that they maintain data integrity.

Response Q(v)

I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below:-

This cannot be provided from DFU as it is recorded within our SOPs which detail our methods of examining devices.

Response Q(vi)

I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below:-

It Is a manual process therefore managed in house. Our procedures are assessed every year by UKAS as part of our accreditation to ISO17025 and FSR Codes of Practice

It should be noted that as a result of the systems adopted by Dyfed-Powys Police in relation to the recording of such information that the information released may or may not be accurate.

(This is a response under the Freedom of Information Act 2000 and disclosed on 28/01/2026)