How do hashes establish chain of custody for digital files?

By replacing the physical idea of an unbroken seal with a cryptographic one. You hash the data at acquisition and re-hash it at each subsequent handoff; if the value still matches, the bytes are unchanged. What hashing does not establish is when the first hash was taken, since that date comes from the acquirer's own system.

What does anchoring a hash to a blockchain add?

It moves the acquisition date out of the acquiring party's control. Instead of a timestamp written by their tooling, the date comes from a public block that anyone can check. That matters specifically when the challenge is that evidence was manufactured or altered before it was collected.

Do courts accept hash-based integrity evidence?

Widely. US Federal Rule of Evidence 902(14) expressly contemplates data identified by hash value, and China's Supreme People's Court has addressed blockchain and trusted timestamping in its 2018 Internet Court Provisions and 2021 Online Litigation Rules. Neither framework treats it as automatically conclusive — it goes to integrity, not to whether the content is genuine.

Chain of Custody for Digital Files

Chain of custody is the documented history of a piece of evidence: who held it, when, and what happened to it. For physical objects it is a paper trail and a sealed bag. For digital files it is mostly hashes.

Why digital evidence is different

A physical object is unique and shows its handling. A file can be copied perfectly, altered invisibly, and the copy is indistinguishable from the original.

So digital chain of custody rests on a different foundation: rather than proving the object was never touched, you prove the bytes are identical to the ones collected. That is what a hash does.

The standard practice is to hash at acquisition and re-hash at every subsequent step. If the value still matches, the data is unchanged. If it does not, something happened, and you know where.

Where the gaps are

Hashing solves integrity. It leaves two questions open, and they are the ones that get contested.

When was the hash taken? The acquisition record says a date. That date is written by the acquirer's tooling and stored in the acquirer's system. If the challenge is that evidence was manufactured or altered before acquisition, the acquisition record is being produced by the party under challenge.

Who held it, and did they have opportunity? That is a documentation and process question, not a cryptographic one.

The first gap is the one a timestamp closes.

Anchoring the acquisition

Hash at acquisition, then anchor that hash to a public ledger. The date now comes from a block rather than from the acquiring system, and anyone can check it.

The effect on the record:

Question	Answered by
Are these the same bytes?	The hash
Since when?	The anchor
Who has held it?	Custody documentation
Was collection sound?	Method and competence of the acquirer
Was it altered before collection?	Nothing can answer this

That last row is worth keeping in view. No integrity mechanism reaches back before the first hash. Chain of custody starts at acquisition, and everything before that is a different kind of argument.

A practical pattern

Hash at acquisition, and record the algorithm, the tool and the operator.
Anchor that hash to a public ledger the same day.
Re-hash at every handoff, and log it.
Store the certificate with the case file, not separately.
Preserve the original bytes untouched; work from copies.

For an evolving set — a log, a growing collection — hash the manifest rather than each item, and anchor the manifest on a schedule. See blockchain logging explained, which is the same mechanism aimed at audit trails.

Where the courts are

Blockchain-anchored evidence has been treated most extensively in China, where the Supreme People's Court's 2018 Internet Court Provisions expressly address electronic data collected through trusted timestamping, hash verification and blockchain, and the 2021 Online Litigation Rules set out how authenticity is reviewed.

In Europe and the US there is no blockchain-specific evidentiary rule, and none is needed: existing frameworks already accommodate authentication by a process shown to produce accurate results. US Federal Rule of Evidence 902(14) specifically contemplates data identified by hash value.

See is a blockchain timestamp valid in court for the fuller position.

What this is not

Not forensic soundness. Anchoring a hash says nothing about whether the acquisition was done properly, whether the right thing was collected, or whether the tooling was sane.

Not proof of what the file means. Integrity is not authenticity of content. A file can be unaltered since collection and still be a forgery created before it.

Not a substitute for documentation. Custody logs, operator records and method notes still do the work they always did. The anchor fixes one date; the process is the rest of it.