{
 "slug": "collection-attestation-receipt",
 "topic_id": "TOPIC-164",
 "cluster": "Law Firms, Courts & Fiduciary Disbursement Identity",
 "tier": "Tier B",
 "title": "Chain of custody for electronic evidence: the declaration nobody can test",
 "summary": "Federal Rules of Evidence 902(13) and 902(14) let electronic records self-authenticate through a certification by a qualified person. That certification is a declaration, and its supporting artefact is a tool-generated hash report.",
 "lede": "Rule 902(14) was a genuine improvement: it let parties authenticate electronic evidence by certification rather than by calling a witness. The certification's strength depends entirely on a human declaration attached to a hash list, and the two are joined only by a PDF.",
 "date": "2024-10-11",
 "category": "Compliance",
 "author_id": "tobias-lindqvist-rao",
 "tags": [
  "e-discovery",
  "FRE 902(14)",
  "chain of custody",
  "forensic collection",
  "evidence authentication",
  "litigation support"
 ],
 "image_title": "Collection Attestation Receipt",
 "schema": "Article",
 "key_takeaways": [
  "902(13) and 902(14) shift authentication from testimony to certification. The certification is only as strong as the binding between the declarant and the manifest.",
  "Self-collection and remote collection have grown faster than the evidentiary practice around them.",
  "Signing the manifest at collection time changes the cross-examination surface from the human's memory to a cryptographic fact."
 ],
 "body": [
  {
   "type": "h2",
   "text": "What the rules actually provide"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "A collection, a declaration and a cross-examination",
   "caption": "The artefact is a narrative. The challenge is about specifics.",
   "nodes": [
    {
     "label": "Evidence collected",
     "sub": "tooling, method",
     "note": "documented in prose",
     "bad": true
    },
    {
     "label": "Declaration written",
     "sub": "after the fact",
     "note": "narrative",
     "bad": true
    },
    {
     "label": "Handled, transferred, stored",
     "sub": "multiple parties",
     "note": "logged separately",
     "bad": true
    },
    {
     "label": "Challenged at trial",
     "sub": "who touched it, when?",
     "note": "testimony",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Rule 902(13) permits self-authentication of a record generated by an electronic process or system that produces an accurate result, shown by a certification of a qualified person. Rule 902(14) permits self-authentication of data copied from an electronic device or file, if authenticated by digital identification — a hash value — and certified by a qualified person."
  },
  {
   "type": "p",
   "html": "The advisory committee's reasoning was practical: requiring live testimony to authenticate routinely generated electronic records imposed expense without contributing to accuracy. That reasoning was correct and the rules have worked."
  },
  {
   "type": "p",
   "html": "Note precisely what 902(14) requires: a hash comparison, plus a certification by a qualified person. Two things, and only one of them is cryptographic."
  },
  {
   "type": "h2",
   "text": "Where the two things come apart"
  },
  {
   "type": "p",
   "html": "The collection tool produces a manifest: source device, item count, hash per item, tool version, timestamps. That artefact is strong. Hashes do exactly what they claim."
  },
  {
   "type": "p",
   "html": "The certification is a declaration, typically drafted later, referencing the manifest by description. It asserts the declarant's qualifications, that they performed or supervised the collection, and that the manifest is accurate."
  },
  {
   "type": "p",
   "html": "Nothing binds the declarant to the manifest at the moment of collection. The challenge therefore attacks the human: who actually ran the tool, what were you doing while it ran, how do you know this manifest is the one from that collection, were you present."
  },
  {
   "type": "table",
   "head": [
    "Element",
    "Evidentiary strength",
    "Attack surface"
   ],
   "rows": [
    [
     "Hash manifest",
     "Very strong",
     "None cryptographically; provenance of the manifest itself"
    ],
    [
     "Tool version and configuration",
     "Strong",
     "Whether it matches what was actually run"
    ],
    [
     "Declarant qualifications",
     "Contestable",
     "Voir dire on expertise"
    ],
    [
     "Declarant's connection to the collection",
     "<strong style=\"font-weight:600\">Weak</strong>",
     "Cross-examination on presence, supervision and recollection"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Why self-collection makes this sharper"
  },
  {
   "type": "p",
   "html": "When a forensic examiner collected everything, the declarant and the operator were the same person and the gap was small. Custodian self-collection and remote collection changed the picture: the person who ran the collection may be a custodian with no forensic training, and the qualified person certifying it may have never touched the device."
  },
  {
   "type": "p",
   "html": "That arrangement can be entirely proper — supervision is a recognised basis — and it widens exactly the gap that cross-examination targets."
  },
  {
   "type": "h2",
   "text": "The Collection Attestation Receipt"
  },
  {
   "type": "p",
   "html": "Sign the manifest when it is produced, by the person whose act it was."
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"forensic_collection\",\n  \"render\": [\n    \"Matter: [identifier]\",\n    \"Custodian: [name]  Source: [device / account / repository]\",\n    \"Scope: [date range, selectors, exclusions]\",\n    \"Items: [count]  Manifest hash: [hash of the full hash list]\",\n    \"Tool: [name] [version]  Method: [targeted | full | logical]\",\n    \"Collected: [start]–[end]\"\n  ],\n  \"collector\": \"[credential assertion]\",\n  \"supervisor\": \"[credential assertion, where applicable]\"\n}"
  },
  {
   "type": "p",
   "html": "The collector signs at collection. Where a qualified person supervises remotely, they sign the same statement — which converts supervision from a claim into an act with a timestamp."
  },
  {
   "type": "h2",
   "text": "What changes in the courtroom"
  },
  {
   "type": "p",
   "html": "The cross-examination moves. Instead of testing whether the declarant recalls the collection accurately, opposing counsel is testing a signature over a manifest produced at the time."
  },
  {
   "type": "p",
   "html": "That is not a small shift. Authentication challenges rarely succeed on the mathematics; they succeed on the human gap. Closing the gap does not make evidence admissible — relevance and other objections are untouched — but it removes a line of attack that currently costs parties real money to defend."
  },
  {
   "type": "h2",
   "text": "What it costs"
  },
  {
   "type": "p",
   "html": "A device gesture at the end of a collection. The tooling change is to emit a canonical statement alongside the existing manifest, which is a report-format addition rather than an architectural change."
  },
  {
   "type": "p",
   "html": "The organisational cost is larger and worth naming: someone has to decide who signs. For self-collection at scale, that decision has implications for how supervision is actually performed, and some organisations will discover their supervision model does not survive being written down."
  },
  {
   "type": "h2",
   "text": "Where courts differ"
  },
  {
   "type": "p",
   "html": "Treatment of 902(13) and 902(14) certifications varies. Some courts have accepted them routinely; others have required more. Nothing here predicts how a given court will treat a signed manifest, and any vendor claiming a receipt guarantees admissibility is overselling."
  },
  {
   "type": "p",
   "html": "The defensible claim is narrower: the certification is stronger when the declarant's connection to the manifest is a cryptographic fact rather than a recollection."
  },
  {
   "type": "h2",
   "text": "What a testable collection record contains"
  },
  {
   "type": "table",
   "caption": "Per-event, signed at the time",
   "head": [
    "Element",
    "Why it matters"
   ],
   "rows": [
    [
     "Hash of the acquired image",
     "The anchor everything else references"
    ],
    [
     "Tooling and version",
     "The first thing an opposing expert questions"
    ],
    [
     "Collector identity",
     "A person, not an account"
    ],
    [
     "Each transfer of custody",
     "Signed by both parties at the moment"
    ],
    [
     "Storage and access events",
     "So a gap is visible rather than assumed"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Forensic practice already hashes the acquired image, which is the hard part and the right instinct. What is missing is that the surrounding events — who collected, with what, and who held it since — are recorded as narrative rather than as signed events."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Declarations are accepted routinely.”</strong> They are, and the ones that get challenged are the ones in cases worth challenging. Routine acceptance is a statement about most cases, not about the ones that matter."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Signing every custody transfer is heavy.”</strong> There are typically three to six per matter. That is a handful of gestures against a cross-examination that can consume a day."
  }
 ],
 "faq": [
  {
   "q": "Does this guarantee admissibility?",
   "a": "No. Authentication is one hurdle among several, and courts differ in their treatment of 902 certifications. It strengthens one element."
  },
  {
   "q": "Who should sign for custodian self-collection?",
   "a": "The custodian who ran it, and the supervising qualified person if one is certifying. Deciding this explicitly is part of the value."
  },
  {
   "q": "Does the receipt contain collected data?",
   "a": "No. It carries a hash of the manifest, not the manifest contents or the data itself."
  },
  {
   "q": "What about collections already completed?",
   "a": "They are unchanged. This applies from adoption forward; retroactive signing would be meaningless and should be refused if a vendor offers it."
  },
  {
   "q": "Isn't hashing the image already standard?",
   "a": "Yes, and it is the right instinct. The gap is that everything around it — collector, tooling, transfers — is narrative rather than signed events."
  },
  {
   "q": "How many custody events are there typically?",
   "a": "Three to six per matter, which is a handful of gestures against a cross-examination that can take a day."
  },
  {
   "q": "Why does tooling version matter?",
   "a": "It is the first thing an opposing expert questions, and a declaration written later frequently gets it approximately right."
  }
 ],
 "sources": [
  {
   "t": "Federal Rule of Evidence 902 — Evidence That Is Self-Authenticating",
   "u": "https://www.law.cornell.edu/rules/fre/rule_902"
  },
  {
   "t": "Forensic collection practice standards and tool documentation."
  },
  {
   "t": "NIST — digital forensics and evidence handling resources",
   "u": "https://www.nist.gov/digital-evidence"
  }
 ],
 "related": [
  {
   "slug": "filing-provenance-model",
   "title": "Hidden instructions in court filings",
   "category": "Compliance"
  },
  {
   "slug": "re-performable-evidence",
   "title": "Replacing the screenshot",
   "category": "Compliance"
  },
  {
   "slug": "order-verification-model",
   "title": "The fake court order",
   "category": "Compliance"
  },
  {
   "slug": "forensic-accountants-guide-crypto-wire-theft-following",
   "title": "Anchoring a fraud investigation to hard evidence",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Collection%20Attestation%20Receipt/1200_630/blog.jpg",
 "wordcount": 1051,
 "url": "/blog/collection-attestation-receipt.html",
 "reading_time": "5 min read",
 "seo_title": "Chain of custody for electronic evidence",
 "meta_description": "Federal Rules of Evidence 902(13) and 902(14) let electronic records self-authenticate through a certification by a qualified person.",
 "hub": {
  "slug": "topics/fiduciary-identity",
  "title": "Courts and fiduciary identity"
 },
 "answer": "Rarely. Electronic evidence collection produces a declaration from the collector describing what they did, and the declaration is prose. An opposing expert can question the method, the tooling, the timing and the handling, and nothing in the artefact answers them without calling the collector.",
 "answer_q": "Can a chain of custody declaration be tested?",
 "glossary": [
  {
   "term": "Chain of custody",
   "def": "The documented sequence of people who held evidence, and the basis for arguing it is unaltered."
  },
  {
   "term": "Acquisition hash",
   "def": "A digest of the collected image, computed at acquisition and used to demonstrate integrity."
  },
  {
   "term": "Collector declaration",
   "def": "The statement describing how evidence was collected — in practice, prose written after the fact."
  }
 ],
 "checklist": {
  "title": "Making custody testable",
  "id": "custody",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Sign at collection, not in the declaration.",
    "text": "Including tooling and version."
   },
   {
    "name": "Sign each custody transfer, both parties.",
    "text": "At the moment, not retrospectively."
   },
   {
    "name": "Bind everything to the image hash.",
    "text": "So the chain has a single anchor."
   },
   {
    "name": "Retain the verification tool with the evidence.",
    "text": "So an opposing party can check it themselves."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising person to the exact instruction, filing or declaration, and produces a receipt a court, an opposing party or a bar regulator can verify without access to the firm's systems.",
  "href": "../docs.html",
  "label": "See legal receipts"
 }
}