After a suspected insider leak of permit-office records, investigators seize a clerk's laptop and relevant log exports. What practice is essential for those materials?

When a municipal laptop and related logs may become evidence of misuse or crime, chain of custody is the discipline that keeps later findings credible in administrative hearings, civil matters, or criminal proceedings. Documented collection, sealing, transfer, and storage create a traceable history of who handled the artifact, when, why, and under what conditions. Hashing, labeled evidence bags or equivalent seals, controlled storage locations, and logged handoffs reduce claims that exhibits were altered, planted, or selectively edited. For city clerkships and similar offices, preserving integrity also protects due process for employees and the public while allowing counsel and investigators to rely on the record.

Reimaging the laptop immediately so the clerk can return to work the same afternoon may destroy volatile and persistent artifacts before imaging and inventory are complete; business continuity must use alternate equipment, not wipe the exhibit. Posting screenshots of the evidence folder to the public intranet for transparency can leak sensitive content, tip subjects, and break controlled disclosure rules. Allowing multiple unlogged staff to browse the raw disk image for curiosity multiplies contamination risk and shreds custody. Exam caveat: operational urgency never excuses undocumented handling—parallel systems restore service while forensics proceeds. Operationally, use a written seizure/imaging checklist, compute and record hashes at acquisition, limit access to named custodians, and store media in a tracked evidence locker with transfer logs.