Shipping data on encrypted hard drives: a step-by-step chain of custody

When shipping a drive beats an online transfer#

Shipping an encrypted drive beats an online transfer when a dataset is too large to move over the network in a reasonable time, or when the recipient will only load data inside an isolated environment. Multi-terabyte archives of photos, scanned documents, machine logs or full mailbox exports are the usual cases.

Physical shipment changes the risk rather than removing it. Online transfer risks misdirected links and unverified recipients; a drive risks loss, theft and quiet copying in transit. Encryption, hashing and a custody log answer those risks, and the table compares the main delivery routes.

The chain of custody in eight steps#

The chain of custody for a shipped drive is a fixed sequence in which every step leaves a record that someone outside the project could check later. Run it the same way every time, so a missing entry stands out instead of blending in.

• 1Step 1, encrypt: copy only the approved release onto new media and encrypt the whole drive or a container on it.
• 2Step 2, hash: generate a manifest with a cryptographic hash for every file and store it with the custody record.
• 3Step 3, seal: place the drive in a numbered tamper-evident bag, with a second person witnessing, and photograph it.
• 4Step 4, log: open the custody record with the drive serial, bag serial, manifest reference and the names of who prepared and sealed it.
• 5Step 5, ship: use a tracked, signature-required service addressed to a named recipient, with nothing on the label about the contents.
• 6Step 6, send the key separately: release it by a different channel only after the recipient confirms the seal.
• 7Step 7, confirm: the recipient recomputes the hashes, reports any mismatch and signs a receipt.
• 8Step 8, return or destroy: close the record with a return receipt or a certificate of destruction.

Encrypting and hashing before the drive leaves#

Encryption for a shipped drive should cover the entire volume or a sealed container, never individual files picked by hand. Hardware-encrypted drives with a recognized validation such as FIPS 140, or software such as BitLocker, FileVault, LUKS or VeraCrypt on a new drive, are common choices, and the decision usually follows what the recipient can open on their side.

Use new or freshly sanitized media, and copy the release your approver signed off from the prepared package rather than from source systems. A drive that once held other files can carry recoverable remnants, and a copy pulled from a live system can include records that preparation removed.

Hashing turns a claim that the files arrived into something both sides can prove. Generate a SHA-256 hash for every file, keep the manifest with the custody record and send the recipient a copy by a channel separate from the drive; any file altered in transit will fail the comparison.

Sealing, shipping and the custody log#

The custody log is the document that shows who held the drive at every point, and it should be opened before the drive is sealed. A second person should witness the sealing and initial the entry, because a log written by one person cannot show that nobody else touched the drive.

Address the package to a named individual, require a signature and keep the label plain. Nothing on the box should suggest it holds company records, and the tracking number belongs in the log, not in the email that carries the key.

Releasing the key only after the seal checks out#

The decryption key should reach the recipient only after they confirm in writing that the bag serial matches the log and the seal is unbroken. Sending the key early means a drive opened in transit could be read before anyone notices the damaged bag.

Use a channel unrelated to the shipment: a password manager share, an encrypted message to a verified contact, or a call to a phone number you already hold rather than one printed in an email. Never put the key in the same message as the tracking details.

Limit who holds the key on each side. One named custodian at the supplier and one at the recipient is easier to account for than a shared mailbox, and the log should record when and to whom the key was released.

When something goes wrong in transit#

A broken seal, a hash mismatch or a missing package is handled by pausing the chain, holding the key back and recording what happened. Encryption is what keeps an incident small, which is the whole reason the key and the drive travel apart.

Bring counsel in quickly if a drive is lost and there is any doubt about the encryption or the key handling. Whether an incident triggers breach notification depends on the data and the laws that apply, and encrypted data whose key stayed secure is often treated differently from readable data.

Illustrative: a 3PL ships its warehouse history#

Illustrative: a fictional third-party logistics provider is licensing years of warehouse management system scan events, transportation management load records and proof-of-delivery photos. The photos alone make the package too large for a practical network transfer, so the parties agree on an encrypted drive.

The IT lead copies the approved release from the prepared package onto a new hardware-encrypted drive, generates a hash manifest and seals the drive in a numbered bag with the operations manager as witness. A tracked, signature-required courier carries it to a named recipient.

The recipient photographs the unopened bag and confirms the serial in writing, and only then does the IT lead release the key through a password manager share. Every hash matches, the receipt is signed and, under the license, the drive is destroyed at the end of the project against a certificate that closes the log.

How SourceX handles drive deliveries#

SourceX never hosts multi-terabyte datasets. Large packages either remain in storage the supplier controls or travel on encrypted drives like the one described here, and the handover is recorded as part of Delivery, the last stage of the SourceX five-step transaction, after the supplier's Approval.

The custody record is filed with the SourceX Evidence Packet for the same package. Because the packet already holds the release authorization, along with provenance, licensing rights, permitted use and the privacy record, the sign-off and the physical handover can be traced to each other.