Week 11 Lab: Chain of Custody

Write a custody log for one file you did not create, and mark the gaps where the record runs out

3 May 2027

Before the session#

Choose a file that arrived from someone else and has been through at least two hands: an attachment forwarded to you, a template someone adapted, a shared document you inherited. You need something whose history you do not already know, because the exercise is reading residue, not recalling events.

In the session#

Build the log backwards from now to the earliest point you can support. Each entry gets three parts: who held it, what happened, and what evidence supports that. Then label every entry: recorded if a system logged it, inferred if you are reading residue, unknown if you are filling in. Most logs come out mostly inferred, and the useful surprise is usually how few entries qualify as recorded.

Afterwards#

Find the point where the record stops and mark it as a gap. Do not close it with a plausible account of what probably happened. A stated gap is a finding; a smoothed-over gap is a fabrication with good manners. Note also which single piece of metadata, had it survived, would have closed the largest gap for you.