Looking for On-Demand Tech Support?
Techmate has the boots-on-the-ground IT Support where and when you need it.
Schedule a Discovery CallChain of Custody for Hardware Handled by Field IT Support Technicians
Quick answer: Chain of custody in field IT support is the signed, timestamped record of who held a device and what happened to it, from unplugging to final disposition. With the average US data breach costing $10.22 million in 2025 (IBM Cost of a Data Breach via CyberScoop, 2025), every laptop, drive and switch that leaves a site needs one.
Every day, field technicians carry laptops out of offices, pull drives from servers, ship failed switches back to manufacturers and pack up equipment from closing sites. Most of the time, nothing goes wrong. But when a laptop goes missing or a drive with customer data cannot be accounted for, the question becomes: who had it last? If the answer lives in someone’s memory or a text thread, you do not have an answer.
Chain of custody answers that question before it is asked. This guide covers when chain of custody matters in field work, what a usable record contains, how an IT field technician should handle devices step by step, what changes for devices that store data, and what to require from any provider delivering onsite hardware support at your locations. It is written for IT leaders at distributed, multi-location companies, where the person removing the hardware is rarely someone on your own payroll.
What is chain of custody in field IT support?
Chain of custody is a sequence of documented handoffs. Each line in the record says that a specific device, identified by serial number and asset tag, moved from one person or place to another at a specific time, in a specific condition. The record is complete only when the device reaches a final state: redeployed to a user, returned to a vendor, sanitized and resold, recycled or destroyed.
The term comes from evidence handling, and the principle is the same. A gap in the record is a gap in accountability. In field IT support the gaps tend to appear in predictable places: the hallway between the user’s desk and the technician’s bag, the back seat of a car overnight, the shipping counter, the receiving dock at a depot, and the storage room where “returns” pile up for weeks.
For a single office with an internal IT team, informal custody often works because the same two people handle everything. For a company with 40 branches and technicians dispatched from a field network, informal custody fails quietly. Different people touch the device at each step, and none of them can see the whole chain unless someone designed the process to make it visible.
When does chain of custody matter for field IT work?
Not every visit needs a formal custody record. A technician who replaces a toner cartridge does not need a signature trail. The trigger is simple: any time hardware leaves its assigned place, changes hands or leaves your control, document it. The common scenarios:
- Equipment recovery from departing employees: data and asset accountability, often with HR or legal waiting on confirmation
- Failed drive or device returns (RMA): returned hardware may still hold readable data
- Office closures and decommissioning: large volumes of equipment moving at once, often under deadline
- Hardware refreshes: old devices leaving service in batches, which is where counts drift
- Security incidents: devices may be evidence and must not be altered
- Regulated environments: health, financial and legal data carry disclosure obligations
- Asset disposition: proof of proper destruction or recycling for auditors and insurers
Regulated industries feel this most. A bank branch closing under a consolidation plan, a law firm returning laptops from a departed partner, and a medical practice swapping a failed workstation drive all carry a reporting risk if a device cannot be located. In healthcare alone, HIPAA Journal counted 710 large data breaches reported to HHS’s Office for Civil Rights in 2025 (HIPAA Journal, 2025). The same report describes loss and theft incidents as now relatively rare and records only one improper disposal breach all year. That is the point: encryption and custody controls work when they are actually followed, and the incidents that remain are the ones where a step was skipped.
What should a chain of custody record include?
A good record is short enough that technicians fill it in completely and detailed enough that an auditor can follow it a year later. These fields cover nearly every scenario:
| Field | What to capture | Why it matters |
|---|---|---|
| Device identification | Type, make, model, serial number, asset tag | Ties the record to one physical device, not “a laptop” |
| Starting location | Site, floor, room, assigned user | Shows where custody began |
| Condition | Working, failed, damaged, missing parts | Prevents disputes about damage in transit |
| Data status | Contains data, encrypted, wiped, drive removed | Determines handling rules for every later step |
| Handoff details | From whom, to whom, date, time, signature | Creates the actual chain |
| Transport method | Carried by technician, carrier with tracking number, courier | Shows how the device moved between locations |
| Storage location | Where it was held, for how long, who had access | Closes the gap that most often goes unrecorded |
| Final disposition | Redeployed, returned to vendor, sanitized, destroyed, recycled | Marks the record complete |
| Evidence | Photos, signatures, certificates of sanitization or destruction | Proves the record, rather than asserting it |
Each handoff adds a line. The record is complete when the device reaches its final state. If you use an ITSM or asset management platform, these fields belong on the asset record itself, with the field ticket linked, so the custody history travels with the device instead of sitting in a closed ticket.
How should an IT field technician handle device custody on site?
The technician is the first link in the chain, and the most important one. If the serial number is wrong or the data status is guessed at the desk, every later step inherits the error. A practical sequence for any visit that removes hardware:
- Identify and photograph the device, serial number label and asset tag before removal. Photograph the screen if the device powers on and shows encryption or login status.
- Record data status: encrypted, wiped, or drive removed. If the technician cannot confirm it, record “unknown” and treat the device as containing data.
- Get sign-off from the site contact or user when collecting a device. A name and signature on a mobile form is enough.
- Bag and label the device, ideally in a tamper-evident bag with the asset tag written on the label.
- Secure devices during transport; never leave them unattended in vehicles, lobbies or unlocked rooms.
- Ship with tracking and record the tracking number on the custody record before leaving the shipping counter.
- Record every handoff to another person or facility, including the name of whoever receives it.
- Confirm final disposition with documentation, then close the record.
Photos do most of the work here. A clear photo of the serial label, the packed box and the shipping receipt settles most disputes in seconds. See our photo documentation standards for what a usable photo set looks like, and what a field technician does for how custody fits into the wider role.
A common mistake is collecting the signature at the end of the day for several devices at once. By then the technician has handled the devices for hours and the user may have left. Collect sign-off at the moment of handoff, device by device.
How do you handle devices that store data?
Laptops, desktops, servers, NAS units, copiers with internal drives, phones and some network appliances all store data. They need extra care because a lost device is not just a lost asset; it may be a reportable incident.
- Confirm encryption status before removal where possible, and record it with a photo or screenshot.
- Remove or sanitize drives before devices leave your control when policy requires. See onsite drive sanitization and destruction.
- Use drive retention options with vendors where available, so failed drives stay with you during warranty replacement. See smart hands for hardware break-fix under OEM warranty.
- Keep sensitive devices separated from general returns, physically and in the record.
- Record each removed drive as its own custody item, with its own serial number, once it is separated from the host device.
Sanitization itself should follow a recognized standard. NIST finalized SP 800-88 Revision 2, its media sanitization guideline, in September 2025, replacing the 2014 version and framing sanitization as an organizational program rather than a one-off technique (NIST, 2025). For field work, that means your custody process and your sanitization method should be written down together: which data status triggers which method, who performs it, and what evidence comes back.
The choice of where sanitization happens drives the custody risk:
| Approach | Custody risk | Best fit |
|---|---|---|
| Sanitize or destroy drives on site before removal | Lowest: data never leaves the building | Regulated data, office closures, departing executives |
| Remove drives on site, ship chassis separately | Low: drives travel under separate, tighter custody | RMAs with drive retention, refreshes where chassis are resold |
| Ship encrypted devices intact to a depot | Moderate: depends on confirmed encryption and tracked shipping | Redeployment programs, routine laptop recovery |
| Ship unencrypted or unknown-status devices intact | High: a lost box may mean a reportable breach | Avoid; treat as an exception that needs approval |
What should you require from field IT support providers?
When an outside provider handles your hardware, their process becomes your process. Ask for these in writing before the first dispatch:
- A chain of custody process documented in writing, with a sample record
- Custody records for every device technicians remove or ship
- Secure transport practices, including a rule against leaving devices unattended in vehicles
- Notification of lost or damaged devices within a defined time
- Integration of custody records into ticket closeouts, not sent separately on request
- Certificates for destruction or disposition performed by the provider or its vendors, with serial numbers listed
- A named escalation contact for custody exceptions
Include these in your contract under data handling, so they are obligations rather than preferences. See outsourced IT support contract clauses for language to adapt.
During evaluation, ask the provider to walk through a real scenario: “A technician collects six laptops from a closing branch in another state. Show me every record that gets created between the user’s desk and our depot.” A provider with a working process answers in specifics. One without it answers in reassurances.
How do you manage chain of custody at scale across many locations?
Custody failures at scale are almost always reconciliation failures. Nobody steals the 47th laptop; it simply never gets matched against the list. For refreshes, closures and recovery programs involving many devices:
- Use one standard custody form or digital record for every site and every technician.
- Build the expected device list before dispatch, from your asset system, and give it to the technician.
- Reconcile collected devices against the expected list daily, not at project end.
- Track open items until final disposition, with an owner for each one.
- Report exceptions immediately: missing devices, extra devices not on the list, serial mismatches.
- Reconcile again at the receiving depot, so shipping losses are caught within days.
Large programs benefit from a project lead who owns the reconciliation across all sites, which is where IT project and rollout field support earns its cost. For specific scenarios, see the office closing IT checklist and the IT offboarding checklist for distributed teams.
How custody requirements shift by site type:
- Bank and credit union branches: expect auditors to ask for certificates by serial number; plan on-site drive destruction for closures. See IT services for banks.
- Law firm offices: client confidentiality and litigation holds mean some devices must be preserved, not wiped. Confirm holds before any sanitization. See legal IT services and support.
- Retail stores: point-of-sale devices and back-office PCs often move during remodels; tie custody to the store number and project phase.
- Shared or coworking offices: storage rooms may not be secure; avoid holding devices on site overnight.
What mistakes break chain of custody most often?
- Recording model instead of serial number. “Dell Latitude” identifies nothing when a branch has twelve of them.
- Assuming encryption. A policy that requires encryption is not proof that a specific device was encrypted.
- Undocumented storage. Devices sit in a closet for three weeks and nobody records who had the key.
- Batch signatures. One signature for “all equipment collected” cannot prove which devices were handed over.
- Shipping without recording the tracking number. A receipt in a technician’s pocket is not part of the record.
- Closing the ticket before disposition. The visit ends, but custody does not. Keep the asset record open until the final state is confirmed.
- Accepting certificates without serials. A destruction certificate that says “40 drives” does not prove your 40 drives were destroyed.
How should field IT support providers report custody?
Field IT support providers should include custody records in every closeout that involves removing or shipping hardware. The closeout should list each device by serial number, its data status, the photos taken, the handoff signatures, the tracking number if shipped, and the current custody state. When disposition happens later, the provider should send the certificate referencing the same serial numbers and ticket number.
Consistent field IT support custody records make audits and investigations straightforward. When an auditor asks where a specific laptop went, you search one serial number and see the whole chain. When a security team needs to know whether a lost device held data, the answer is already recorded. IBM’s 2025 research found that organizations took an average of 241 days to identify and contain a breach (IBM via CyberScoop, 2025). Good custody records do not prevent every incident, but they remove days of reconstruction from the investigation.
Techmate technicians document hardware handling as part of field closeouts across 450+ US cities, drawing on a network of 7,000+ vetted technicians. If you need something more specific, contact us.
The bottom line
Chain of custody turns hardware handling from an assumption into a record. Document every device, handoff and final state, take extra care with devices that store data, reconcile daily on large programs, and require providers to follow and report a written process. When something goes missing, you will know exactly where to look.
Frequently Asked Questions
What is chain of custody in IT?
Chain of custody in IT is a documented record of who possessed a device, when, where and in what condition, from removal through final disposition. Each handoff adds a line with names, times and evidence such as photos or signatures. The record is complete only when the device is redeployed, returned, sanitized, recycled or destroyed, and that final state is confirmed.
When is chain of custody needed for IT hardware?
You need it whenever hardware leaves its assigned place or your control: recovering devices from departing employees, RMA returns, office closures, hardware refreshes, security incidents and asset disposition. It matters most in regulated environments such as banking, legal and healthcare, where a device that cannot be located may trigger disclosure obligations or audit findings.
What should a chain of custody record include?
At minimum: device type, model, serial number and asset tag; starting location and user; condition; data status; each handoff with names, date and time; transport method and tracking number; storage location; final disposition; and supporting evidence such as photos, signatures and certificates. Keep it on the asset record so the history follows the device.
How should technicians transport devices with data?
Technicians should confirm and record data status before removal, remove or sanitize drives when policy requires, bag and label each device, and never leave devices unattended in vehicles or public areas. Shipments should use tracked carriers, with the tracking number added to the custody record before the technician leaves the counter. Unknown data status should be treated as containing data.
What is IT asset disposition?
IT asset disposition (ITAD) is the process of retiring IT equipment through redeployment, resale, recycling or destruction, with documentation of the final outcome. For devices that store data, disposition should include sanitization to a recognized standard such as NIST SP 800-88 and a certificate that lists each device or drive by serial number.
What should IT providers report about hardware handling?
Providers should report custody records for every device removed or shipped, listed by serial number, along with photos, signatures, tracking numbers and current custody state. They should notify you of lost or damaged devices within a defined time and supply certificates for any destruction or disposition they or their vendors perform, tied to your ticket numbers.
Is chain of custody part of standard field IT support?
It should be for any visit where hardware is removed, swapped or shipped, but practices vary widely between providers. Ask for a written process and a sample record before the first dispatch, and put custody reporting in the contract. A field IT support provider with a mature process will show you the records without hesitation.
Not sure whether your current field providers are documenting hardware the way your auditors expect? Book a free 30-minute IT support audit and we will review your custody, closeout and dispatch practices across your locations.
