Chain of Custody in Paranormal Research: How to Preserve the Integrity of Digital Evidence

Introduction

A recording may appear compelling, but its value can be weakened if nobody can establish where it came from, who handled it, whether it was edited or which version was analysed.

Digital evidence integrity is not only a concern for police or corporate incident response. Any research team collecting audio, video, photographs or sensor logs benefits from a documented chain of custody.

A chain-of-custody record tracks the handling of evidence from collection through storage, transfer, analysis and reporting. It helps reviewers understand what happened to a file and whether the version examined is the same one originally preserved.

1. What Is a Chain of Custody?

A chain of custody is a chronological record of who collected, accessed, transferred, stored or processed an item of evidence, and when those actions occurred.

For digital evidence, the record may include:

  • Original file name and format.
  • Collection date, time and location.
  • Recording device and settings.
  • Person responsible for collection.
  • Storage location and transfer history.
  • Cryptographic hash values.
  • Copies created for analysis.
  • Tools and processing steps.
  • People who reviewed or exported the material.

The goal is traceability, not merely paperwork.

2. Preserve the Original

When a recorder or camera is returned from a session, avoid editing or renaming source files before preservation.

A sensible workflow is:

  1. Record device details and collection circumstances.
  2. Copy files using a documented process.
  3. Preserve the original media where feasible.
  4. Create a working copy for analysis.
  5. Record file metadata and cryptographic hashes.
  6. Restrict access and maintain secure backups.

If a file must be converted or repaired to make it readable, retain the original and label the derivative clearly.

3. What Does a Cryptographic Hash Do?

A cryptographic hash function converts input data into a fixed-length value. SHA-256 is a widely used hash algorithm.

If the contents of a file change, its SHA-256 hash will ordinarily change as well. Comparing hashes can therefore help detect whether a file has changed since a previous hash was calculated.

A hash does not prove:

  • That the recording depicts a genuine event.
  • That the device clock was correct.
  • That the file was not manipulated before the first hash.
  • Who created the recording.
  • That the collection process was reliable.

Hashing is an integrity check, not a truth detector.

4. Example: Calculating a SHA-256 Hash

On Windows PowerShell:

Get-FileHash "C:\Evidence\original_audio.wav" -Algorithm SHA256

On Linux:

sha256sum original_audio.wav

Record the output, the date and time, the tool or command used, and the file to which it applies. Store the manifest separately and protect it from casual modification.

5. Evidence Register Template

| Field | Example entry | |---|---| | Evidence ID | AERM-2026-001 | | Original filename | REC_001.wav | | Type | Audio recording | | Collected | 2026-11-12, 22:15 local time | | Device | Recorder make/model and serial number | | Collector | Initials or authorised identifier | | Original storage | Sealed/controlled media or restricted archive | | SHA-256 | Full hash value | | Working copy | REC_001_working.wav | | Access history | Date, person, purpose | | Processing | Tool, version and exact operations | | Review status | Pending / reviewed / unresolved |

The example ID is illustrative. Teams should adopt a consistent naming convention and avoid embedding sensitive personal details in file names.

6. Metadata and Time Integrity

Metadata can provide useful context, but it is not automatically reliable. Device clocks may be wrong, time zones may be unclear and conversion software may remove or rewrite metadata.

Document:

  • Time zone and daylight-saving status where relevant.
  • Device clock offset against a trusted time reference.
  • Recording start and end times.
  • File creation and modification timestamps.
  • Sampling rate, bit depth, frame rate and codec.
  • Any conversion or export operation.

Never silently correct timestamps. Preserve the original value and document any calculated correction.

7. Working Copies and Processing Logs

Noise reduction, cropping, stabilisation, contrast changes and format conversion can alter data. Keep an untouched source and create clearly named derivatives.

A processing log should state:

  • Input and output file names.
  • Software and version.
  • Operation and parameters.
  • Date and operator.
  • Reason for processing.
  • Whether the operation was lossy.
  • Hashes of the resulting files.

Do not present an enhanced or AI-generated output as an original recording.

8. Access Control, Privacy and Retention

Recordings may contain private conversations, faces, personal documents or sensitive location details. Limit access to people who need it, obtain appropriate consent and establish retention rules.

Use secure storage, access controls and backups. If evidence is shared externally, record what was shared, with whom, when and under what conditions.

Conclusion

A strong chain of custody makes evidence traceable. Preserving originals, calculating hashes, documenting transfers, recording processing steps and controlling access allow another reviewer to understand how a file was handled.

These practices do not prove that an event is paranormal. They protect the integrity of the material used to evaluate it. For AERM, evidence that cannot be traced or reproduced should be reported with appropriate limitations rather than presented with unwarranted certainty.

AERM principle: No anomaly is considered paranormal until environmental, psychological, technical, and scientific explanations have been systematically evaluated.

References and Further Reading

  1. National Institute of Standards and Technology (NIST). Guide to Integrating Forensic Techniques into Incident Response, SP 800-86. https://doi.org/10.6028/NIST.SP.800-86
  2. NIST. Secure Hash Standard (SHS), FIPS PUB 180-4. https://doi.org/10.6028/NIST.FIPS.180-4
  3. Scientific Working Group on Digital Evidence (SWGDE). Best practices and guidance. https://www.swgde.org/
  4. ISO/IEC 27037:2012. Guidelines for identification, collection, acquisition and preservation of digital evidence.

About AERM

AERM is an independent research and media initiative focused on the systematic evaluation of unusual reports. Paranormal Frame communicates evidence-led methods through accessible research and documentary content.

Educational Disclaimer

This article is educational and is not legal advice or a substitute for jurisdiction-specific evidence-handling requirements. Obtain consent and follow applicable privacy, data-protection and site-access laws.