# Chain of Custody for Audio Evidence: A Practical Guide

Chain of custody proves that the evidence presented in court is the same evidence that was collected — unaltered, unedited, and attributable to a specific source.

For audio evidence, that means documenting every action taken on the file from the moment it enters your control to the moment it is admitted as an exhibit.

Why chain of custody matters

Audio files are easy to edit. A gap can be inserted. A section can be deleted. Enhancement can be applied without documentation. Once edited, the original may be lost.

When you present audio evidence, opposing counsel will ask:

  • Is this the original file?
  • Has it been altered?
  • What processing was done?
  • Can you prove this is the same file you received?

If you cannot answer those questions with documentation, the evidence becomes vulnerable to exclusion.

The SWGDE standard

The Scientific Working Group on Digital Evidence (SWGDE) publishes Best Practices for Forensic Audio. The standard is used by forensic labs, law enforcement, and experts worldwide.

The core principle: preserve the original, document every action, maintain a verifiable trail.

That standard applies whether you are a forensic expert or a defense attorney working alone with a voicemail recording.

Step 1: Acquire and hash immediately

The moment you receive an audio file — from a client, an investigator, a subpoena response — hash it.

SHA-256 is the standard. It produces a unique 64-character fingerprint of the file's contents. Change one bit in the file and the hash changes completely.

On macOS or Linux:


shasum -a 256 evidence-audio.m4a

On Windows:


certutil -hashfile evidence-audio.m4a SHA256

Save the hash in a custody log. That hash is now the file's identifier. If anyone later asks "is this the same file?" — re-hash it. If the hashes match, it is the same file, byte-for-byte.

Step 2: Preserve the original

Copy the original file to a write-protected location. Never work on the only copy.

Best practice:

  • Copy to an external drive or network storage
  • Mark the copy read-only
  • Document the copy action in your custody log (timestamp, destination, hash of the copy)

The original must remain available for re-examination. If you lose the original and present only a processed version, opposing counsel will argue you destroyed evidence.

Step 3: Document the container and metadata

Audio files have metadata: creation date, modification date, encoder information, sample rate, bit depth, container format.

Extract and preserve that metadata:


ffprobe -v quiet -print_format json -show_format -show_streams evidence-audio.m4a > metadata.json

That metadata may contain forensically relevant information:

  • When the file was created
  • What device recorded it
  • Whether it has been re-encoded

Save the metadata report in your custody file.

Step 4: Log every processing step

Every action you take on the audio must be documented:

  • Enhancement — which tools, which settings, in what order (see enhancement best practices)
  • Format conversion — from what to what, which codec, which tool
  • Trimming or editing — what was removed, why, and where the removed sections are preserved
  • Transcription — which models, how many passes, human review (understanding AI transcript admissibility)

If you apply noise reduction, document the exact command:


ffmpeg -i original.m4a -af "highpass=f=200,lowpass=f=3000,afftdn" enhanced.m4a

That command is reproducible. Anyone with the original can run it and verify your result.

Step 5: Maintain a custody manifest

A custody manifest is a running log of:

  • Acquisition — when you received the file, from whom, hash
  • Preservation — where the original is stored, write-protection status
  • Processing — each step, command, input/output hashes
  • Transfers — if the file was sent to another party (expert, co-counsel), when and to whom
  • Access — who accessed the file, when, and for what purpose

The manifest answers the chain-of-custody questions before they are asked.

What the manifest looks like

A minimal custody manifest:


CUSTODY MANIFEST — exhibit-04.m4a

ACQUISITION
  Date: 2025-11-04T09:14:03Z
  Source: Client voicemail forwarded via email
  Filename: VM_20251104.m4a
  SHA-256: 7f3a91cc482b3f7...8d4be081
  Container: M4A/AAC, 48 kHz mono, 128 kbps

PRESERVATION
  Original stored: /secure/originals/exhibit-04-original.m4a (read-only)
  Hash verified: 2025-11-04T09:18:22Z — match

PROCESSING
  [2025-11-04T09:30:15Z] Enhancement applied
    Recipe: denoise-voice-isolate-v2
    Command: ffmpeg -i exhibit-04-original.m4a -af "highpass=f=200,afftdn,speechnorm" exhibit-04-enhanced.m4a
    Output hash: a3f821bc9d4e...19f3c204

  [2025-11-04T09:45:00Z] Transcription — 5 passes
    Models: whisper-large-v3, wav2vec2, nemo-parakeet, vosk-en, faster-whisper
    Consensus threshold: 3/5 agreement
    Human verification: 41 lines verified by operator

EXPORT
  Transcript: exhibit-04-transcript.txt
  Provenance: per-line labeling (verified, corrected, machine-only)
  Custody manifest included in export header

That manifest is your defense against chain-of-custody challenges.

When to re-hash

Re-hash the file:

  • After every processing step (to verify output integrity)
  • Before transfer to another party
  • Before submission to court
  • Any time authenticity is questioned

If the hash matches the original, the file is unchanged. If it does not, something altered it — and you need to investigate.

Working copies vs. originals

Processing requires working on a copy. The custody rule:

  • Original — preserved, read-only, never edited
  • Working copy — processed, enhanced, transcribed
  • Every step documented — what was done, to which file, producing which output

If you produce five enhanced versions using different recipes, save all five and log which one was used for the final transcript.

Authentication in court

When the time comes to authenticate the audio, you will testify (or a witness will testify) to:

  1. The file's origin — how it was obtained
  2. The hash at acquisition — proving this is the same file
  3. The preservation method — where the original is stored
  4. The processing log — what was done, reproducibly
  5. The output — and how it relates to the original

The custody manifest is your script for that testimony.

VeriVox's built-in chain of custody

VeriVox's first stage is Ingest — it automatically:

  • Hashes the file (SHA-256)
  • Extracts container and codec metadata
  • Writes a custody manifest
  • Preserves the original in a read-only location

Every subsequent stage appends to that manifest. Enhancement recipes are logged with their exact commands. Transcription passes are documented. Verification actions are timestamped.

The final export includes the full custody trail in the transcript header.

Nothing is taken on faith. See the pipeline →

For legal professionals working with sensitive audio evidence, learn about VeriVox's security and data sovereignty approach →

Checklist: Chain of custody for audio evidence

Use this checklist for every audio file you handle:

  • [ ] Hash the file immediately (SHA-256)
  • [ ] Preserve the original in a write-protected location
  • [ ] Extract and save container/metadata
  • [ ] Document every processing step with reproducible commands
  • [ ] Re-hash after each processing step
  • [ ] Maintain a running custody manifest
  • [ ] Include the manifest in any export or submission
  • [ ] Be able to reproduce your work from the original

FAQ

What if I received the file months ago and did not hash it then?

Hash it now. The current hash is your baseline. If the file is later questioned, you can testify that it has not changed since the date you hashed it. Earlier is better, but late is better than never.

Do I need to hash every intermediate file?

Best practice: yes. Hash the input and output of every processing step. That proves each step produced the documented result.

What if the original file is on a device I no longer have access to?

If you copied the file before losing access, hash the copy and document when and how the copy was made. If you did not copy it and cannot access the original, that is a gap in the chain — and you will need to explain it.

Can I use MD5 instead of SHA-256?

MD5 is cryptographically broken. Courts may question its reliability. SHA-256 is the forensic standard. Use SHA-256.

What if I need to transcribe the recording as well as preserve custody?

Chain of custody and transcription work together. The custody manifest documents what was done to produce the transcript. Learn how to transcribe your own recording while maintaining full custody documentation.

How do I prove the timestamp in my custody log is accurate?

System timestamps can be altered. For high-stakes cases, some practitioners use timestamping services (third-party attestation). For most cases, a contemporaneous log with consistent timestamps is sufficient.