Overview#
Moving evidence between custodians is one of the highest-risk moments in any investigation. A phone handed from a field officer to a forensic lab without a documented handoff, a device transferred between agencies without formal approval, or an emergency submission to a court that bypasses the standard sign-off process: each of these creates a gap that defence counsel can exploit. The Evidence Custody Transfer module manages every transfer event through a structured, cryptographically verified workflow that leaves no room for undocumented handoffs.
The module supports the full spectrum of transfer scenarios encountered by criminal investigation units, inter-agency task forces, financial regulators, and military intelligence units. Standard single-custodian handoffs, dual-signature transfers for high-value or sensitive material, multi-party approvals for inter-agency sharing, and time-sensitive emergency overrides with supervisor authorisation are all handled through configured workflows. Every transfer produces an immutable record before the physical or logical handoff occurs.
Key Features#
- Multi-level authorisation workflows covering single-signature, dual-signature, and multi-party approval scenarios, configurable by evidence classification and transfer type
- Role-based authorisation with eight permission tiers and evidence classification rules that route each transfer to the appropriate approvers automatically
- Automatic routing of transfer requests to the right approvers with escalation procedures when responses are delayed
- Emergency override capability for time-sensitive transfers, requiring supervisor authorisation and generating a flagged audit record for post-incident review
- Real-time custody metadata updates with cryptographic verification applied at the point of transfer, not retrospectively
- Automated notifications to all relevant stakeholders at each stage of the transfer lifecycle
- Full support for inter-agency, inter-departmental, and external entity transfers, including cross-jurisdictional scenarios
- Transfer lifecycle tracking from initiation through completion, with status visible to all authorised parties
- Offline capability for field operations, with secure queuing and automatic synchronisation when connectivity is restored
Use Cases#
- Managing evidence transfers between investigators with proper authorisation documentation at every handoff point
- Facilitating inter-agency evidence sharing through multi-party approval workflows that satisfy each agency's internal requirements
- Handling emergency evidence transfers with expedited authorisation procedures that preserve the audit record while meeting time constraints
- Maintaining an unbroken chain of custody across all transfer events, including transfers that cross jurisdictional boundaries
Integration#
The Evidence Custody Transfer module connects with case management, evidence tracking, and inter-agency data sharing networks, with distributed custody ledger capabilities for multi-organisation environments.
Open Standards#
- W3C Verifiable Credentials Data Model v2.0: Every custody transfer and evidence collection event produces a signed W3C VC (types EvidenceCollection, CustodyTransfer, Verification), forming a cryptographically linked chain of provenance that can be verified independently of the platform database.
- RFC 3161 (Time-Stamp Protocol): Evidence export artefacts receive a cryptographic timestamp token from a third-party Timestamping Authority, providing legally admissible proof of existence at a specific point in time.
- Ed25519 (RFC 8037): Each chain-of-custody entry is digitally signed using an Ed25519 key pair; the same algorithm is used for the proof element of every Verifiable Credential issued for custody transfers.
- FIPS 180-4 / FIPS 202 (SHA-256, SHA-512, SHA3-256, BLAKE2b): Evidence file integrity is verified before and after each transfer using multiple hash algorithms; SHA-256 is the primary binding hash recorded in custody records and VC credential subjects.
- W3C Decentralised Identifiers (DID), did:web: The platform publishes its signing key under a did:web identifier, allowing any relying party to resolve the DID document and independently verify custody VC signatures.
- JSON Web Token / JSON Web Key (RFC 7519 / RFC 7517): Verifiable Credentials are serialised as compact JWTs and the Ed25519 signing key is represented as a JWK, enabling standard JWT libraries to verify custody proofs.
- ISO 19005 (PDF/A-1B, 2B, 3B, 4F): Custody reports exported for court submission are rendered in ISO-standardised archival PDF variants, with the specific part selectable per jurisdiction requirement.
- GraphQL: All custody transfer operations, queries for chain retrieval, mutations for transfer initiation and VC issuance, are exposed through a typed GraphQL API.
Last Reviewed: 2026-02-09 Last Updated: 2026-04-14