Copyright Goodheart-Willcox Co., Inc. 850 Computer Service and Repair Computer Evidence Chain of Custody To be completed by initial collector Evidence collected by (name): ______________________________________________________ Date/time collected: _______________________________________________________________ Description of evidence: ___________________________________________________________ _________________________________________________________________________________ Collection method (operating system, utility, commands, etc.): _________________________________________________________________________________ _________________________________________________________________________________ Where is evidence originally stored? ________________________________________________ How is evidence originally secured? ________________________________________________ Collector signature: _______________________________________________________________ Evidence copy history: Date Copied By Copy Method Disposition of original and all copies Transfer History: Date Released by (print name, sign) Received by (Print name, sign) How is evidence secured? Goodheart-Willcox Publisher Figure 24-12 A computer evidence chain of custody form should be used whenever unethical, illegal, or prohibited content or activity is discovered on a device.