iPhone Chain of Custody, Documented

Chain of custody is the documented history of who held a piece of evidence and what was done to it, from the moment it was seized or received through acquisition and analysis to the report a court sees. Its job is narrow and vital: to let a party show that the evidence presented is the same evidence that was collected, accounted for at every step. A break in that history, an unexplained gap or an undocumented handoff, is one of the most reliable ways for otherwise powerful evidence to be excluded, because it opens the door to the argument that the data could have been altered.

For a phone the account has to survive across two very different phases. There is physical custody, the seizure, storage and transfer of the device itself. There is the analysis phase, where the evidence is acquired and examined. Sherlock Forensics iPhone Analyzer is built to document the analysis phase rigorously and to provide the integrity anchors that let the whole account be verified end to end. It does not replace the disciplined physical handling around it; it makes the analysis link of the chain provable rather than assumed.

The custody record Sherlock produces is specific, not decorative. Every report carries the case and evidence numbers that anchor it to the matter, examiner identification that records who performed the analysis and a disclosed methodology that shows how. The device profile ties the analysis to a specific handset by its model, serial, IMEI and account, so the evidence is bound to an identified device rather than a generic one. Each element is a line in the account a party can point to when the handling is questioned.

The device profile deserves emphasis, because it is where the analysis phase meets the physical one. By recording the same identifiers logged when the phone was seized, it lets a party match the analyzed evidence to the seizure record and show they are the same device. That single check closes the gap between what was taken into custody and what was examined, which is exactly the seam an opposing party tests. Documented once and carried through the report, it turns an assumption into a fact on the record.

Documentation says what happened; integrity anchors prove it. Sherlock analysis is 100 percent read-only, so the source evidence is never written to or modified during examination, which removes the challenge that the analysis itself altered the data. On top of that, per-artifact SHA-256 hashing gives each record a fingerprint captured at analysis time. An optional evidence-integrity manifest gathers those hashes so the whole production can be checked against the source later.

Read together, these anchors make the custody account testable rather than merely stated. A party does not just assert that a message is unchanged; they recompute its hash and show it matches, the documentation practice set out in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. The read-only method covers the moment of analysis, the hashing covers everything after it. Between them the analysis link of the chain is verifiable at any later point without trusting anyone's word for it.

An honest custody page has to be clear about where the software stops. Sherlock documents the analysis phase and provides the integrity anchors, but physical custody is a human process that no tool performs: the seizure of the device, its storage in a secure facility, the transfers between people and the logs that record each handoff. Those remain the responsibility of the agency, the examiner and the procedures they follow. The tool cannot vouch for handling it never saw.

What it can do is make its own link unbreakable and verifiable, so the analysis phase is never the weak point. A complete chain of custody is therefore a joint product of disciplined physical handling on one side and a documented, read-only, hashed analysis record on the other. Sherlock delivers the second half rigorously and states plainly that the first half is yours, which is the honest division of labor a court expects to see.

Sherlock produces the documented, read-only, hashed analysis record that supports a chain of custody. It does not perform physical custody, does not unlock a locked device and does not decide admissibility, all of which sit outside the software. It documents the analysis link, ties it to the case device through the profile and provides the hashes and manifest that let the record be verified. A complete chain still depends on lawful acquisition and disciplined handling around the analysis. Sherlock reports what the acquired evidence holds and documents how it was examined, which is what an examiner can defend on the stand.

Download the free edition, open a backup or extraction and see the read-only, hashed record for yourself. Produce the full court-ready report with the integrity manifest when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Defense attorney iPhone analysis · The forensic image load workflow · The full parser list · Product page