Chain of Custody for Survey Data: Why It Matters

A survey firm signs and seals its work, and then that work goes quiet. Months or years later it can resurface in a boundary dispute, a construction claim, a client audit, or a courtroom. When it does, the question is rarely whether the fieldwork was good. It is whether the data you are showing is the same data the rover recorded, unchanged, and whether you can prove who held it at every step in between. That proof is a chain of custody, and for survey data it is not paperwork for its own sake. It is part of standing behind the survey.

Most crews already think carefully about the observations themselves: redundancy, closure, the right control. Far fewer think about what happens to the raw files after the rover comes off the pole. Those files get copied to a laptop, emailed to the office, dropped on a shared drive, re-saved into a project folder, and handed between people, and almost none of that leaves a record. This is the weak point in moving survey data from the field to the office, and it is the part a dispute tests hardest.

This post covers what chain of custody actually means for survey files, the specific ways an undocumented handoff breaks it, and the practical steps that keep it intact from the rover to the archive.

What chain of custody means for a survey file

Chain of custody is a documented, unbroken account of a piece of evidence from the moment it is created to the moment it is presented. Borrowed from forensics, the idea maps cleanly onto survey data, because a raw observation file is evidence: it is the primary record of what the instrument measured, on a given day, in a given place. A defensible chain answers four questions about that file at every point in its life.

• Who collected it. The crew and instrument that recorded the raw observations, and when.
• Who received it. The named person at the office who took the file in and became responsible for it.
• Who held it at each step. An unbroken account of custody, with no gap where the file belonged to nobody.
• Proof the data is unchanged. A way to show the bytes you have now are the exact bytes that came off the instrument, not a re-saved or re-exported copy.

The last point is the one people underestimate. It is not enough to say a file with the right name exists. You have to be able to demonstrate that the file has not been altered since collection, deliberately or by accident. A checksum, a short fingerprint computed from the file's contents, is what makes that demonstrable. If the fingerprint recorded at collection still matches the file years later, the data is provably the same. If it does not, you know something changed, and roughly when. This is the same principle behind any documented file chain of custody, applied to the files a survey lives or dies on.

How an undocumented handoff quietly breaks the chain

The chain rarely breaks in a dramatic way. It breaks in small, forgettable moments that nobody records, and the damage only shows up when someone asks a hard question later. Three failure modes account for most of it.

The re-saved file

A raw file gets opened in the office software and exported, or dragged into a project folder and saved again under a cleaner name. The coordinates may be fine, but the file is no longer bit-for-bit the original. If your only copy is the re-saved one, you have lost the ability to prove the data is unchanged, because the thing you would check against is gone. A crew that keeps only the processed output has thrown away the evidence and kept the argument.

The lost original

Raw observations live on a data collector or a phone until they are offloaded, and then on whatever laptop did the offloading. If nobody deliberately preserves an untouched copy, the original can be overwritten on the next job, aged out of a temp folder, or lost when a device is wiped. The processed survey survives, but the primary record behind it does not, and a processed result you cannot trace back to raw data is far weaker in a dispute.

No record of who received what

A file is emailed in and someone at the office starts working on it, but there is no record of who took it in or when. If it turns out a file was missing, or the wrong version was processed, there is no way to say where the break happened. Custody that cannot name a receiver is not custody. It is a folder of files with a story attached, and stories do not hold up when someone with a stake in the answer starts pulling on them.

What a defensible custody record contains

A custody record does not need to be elaborate. It needs to be complete and hard to alter after the fact. For a single survey packet, the record that stands up later contains a specific short list of things, each captured at the moment it is cheap to capture rather than reconstructed afterward.

• An identifier for the packet. A stable number or job reference everyone can quote, tied to the raw files it contains.
• The file list, frozen at collection. Names, count, and total size, recorded when the data leaves the field, not reconstructed from what happens to be in a folder now.
• A checksum per file. A fingerprint computed from the contents, so the data can be proven unchanged at any later date.
• A named submitter and a named receiver. Who sent the data in and who deliberately took responsibility for it at the office.
• Timestamps for each transfer of responsibility. When it was submitted, when it was accepted, when it was filed.
• An untouched copy of the raw data. A write-once archive of exactly what arrived, kept separate from the working files.

Read that list and a pattern appears. Every item is either an identity, a time, or a fingerprint, and none of it requires judgment or extra fieldwork to produce. That is what makes a custody record practical: it is a set of facts recorded automatically as the data moves, not a form someone fills in at the end of a long day.

Practical steps to keep custody intact

Keeping a chain of custody is mostly about removing the moments where it can break. The steps below do that. They are the same discipline behind how a survey crew should deliver field data, viewed through the lens of what a dispute will later ask for.

1. Route everything through a single intake. When raw data enters the office one way, through one queue, there is one place the custody record begins. Data that arrives by email one day and a USB stick the next has no consistent starting point, and a chain with no defined start is easy to attack.
2. Require explicit acceptance by name. Receiving data should be a deliberate act by a specific person, not something that happens because a file appeared in a folder. Downloading a file to look at it is not the same as taking responsibility for it. Only a named acceptance moves custody from the field to the office, and the record should say who and when.
3. Fingerprint the files at the edge.Compute a checksum for each file on the device, before it leaves, and verify it when it arrives. That single step is what turns “we think this is the raw data” into “we can prove this is the raw data,” and it costs nothing once it is built into the process.
4. Keep a write-once archive of the raw data. The moment data is received, copy it to storage that cannot be edited or overwritten, and leave it there untouched by whatever processing and retention happen to the working files. This is the copy you check the fingerprint against in two years.
5. Log every event in an append-only trail. Each submission, acceptance, download, and filing should be written to a log where entries carry an actor and a timestamp and cannot be altered after the fact. An audit trail that an administrator can quietly edit is not a record a court will trust.

None of these steps asks the crew to do more surveying or the office to keep a manual ledger. They ask the workflow to record what it is already doing. RoverDrop is built around exactly this shape: raw files enter one intake queue, a numbered receipt is issued the instant they are uploaded and checksum-verified, responsibility passes only when an office tech accepts the packet by name, an append-only trail records every event, and a write-once archive copy of the raw data is stored automatically. The custody record is a byproduct of the handoff, which is the only version of it that survives a busy month.

Custody is part of the deliverable

A survey firm sells more than coordinates. It sells work a client can rely on and, if it comes to it, defend. The raw data is the foundation of that reliability, and a chain of custody is what keeps the foundation provable. Without it, a firm with excellent fieldwork can still be caught flat when a file's history is questioned, because good measurements and a good record of custody are two different things, and only one of them was ever written down.

The good news is that the record is cheap to keep and expensive only to recreate. Route raw data through one intake, accept it by name, fingerprint it, archive an untouched copy, and log every step, and you will be able to answer who collected the data, who received it, who held it, and whether it is unchanged, in plain records, on the day someone finally asks. That is what it means to stand behind the survey long after the crew has moved on.