Chain of custody is the paper trail that proves a piece of evidence is what it claims to be and has not been tampered with. It records, in order, every person who collected, stored, or accessed an item, along with dates, times, and the actions taken. In legal settings an unbroken chain is what makes evidence admissible; a gap or an undocumented handoff can render it worthless.
For OSINT, where evidence is digital and easily copied or edited, chain of custody underpins provenance and credible verification. Best practice is to capture the original (with hashes, timestamps, and full URLs), record exactly how and when it was obtained, and store it read-only — so that months later you can show the material is authentic and account for it at every step.