# Chain of Custody Chain of custody records who possessed or controlled an object or record, when custody changed, and how integrity was preserved. A serial number can identify an item, but it does not establish possession, use, ownership, or an unbroken custody history. ## Notebook relevance [[Scanned_20260730-1230]] preserves many durable identifiers and several paired-device annotations, but usually lacks acquisition, transfer, location, service, and disposal events. Its labels are identity evidence; a complete custody record would require dated receipts, photographs, handoffs, storage locations, and integrity checks. ## Relationships [[Hardware Provenance]] · [[Asset Management]] · [[Device Identity]] ## Scanned_20260730-1913 overlay [[Scanned_20260730-1913]] adds a complementary form of custody evidence: administrative documents rather than device labels. Toll notices, payment schedules, residence dates, correspondence, property solicitations, baggage records, tickets, receipts, and boarding documents on PDF pages 18–20, 27, 36, 43, 58, 64–65, 70, and 82–84 create dated anchors for people, places, routes, and counterparties. These artifacts support [[Documentary Evidence Continuity]]. They do not automatically validate every institutional claim printed on them, and sensitive payment, booking, account, and credential identifiers remain redacted. ## Scanned_20260730-1845 overlay [[Scanned_20260730-1845]] adds legacy evidence anchors: a 2015 Delta Dental record, a December 12, 2015 flight and lost-item report, a 2018 RealMe lead, and later legal/institutional portal records on pages 63–67. The notes show why an [[Institutional Evidence Graph]] needs both the original artifact and the institution's authority scope. The archive preserves dates, roles, and source locations while minimizing personal numbers and secrets. A copied note or portal name is not an unbroken custody chain or proof that a filing exists. ## Scanned_20260803-1201 overlay [[Scanned_20260803-1201]] is the collection's clearest physical chain-of-custody experiment. On January 5, 2021, loose objects were grouped into numbered envelopes, named, dated, and signed. A ThinkPad and removed memory module were separated as Cards #22–23; a deposit receipt and temporary debit card were isolated as Cards #20 and #19; business cards and notes continued the numbered series through Card #26. The method establishes retrospective cataloging, object identity, and witness attribution. It is not a complete forensic chain: acquisition times, tamper seals, full manifests, transfers, storage conditions, hashes, and independent witnesses are generally absent. See [[Event Sourcing]], [[Event - ThinkPad Provenance Certification]], and [[Event - Card 20 Deposit and Claimed Return]].