figma guide
Designing forensic evidence management and chain of custody UI in Figma: artifacts, custody, and legal hold
Design forensic evidence and chain of custody UI in Figma with artifact intake, hash verification, custody transfers, legal hold flags, and Dev Mode specs for enterprise IR.
- Published
- Updated
- Jul 25, 2026
- Read time
- 8 min
- Level
- Intermediate
Quick answer
Forensic evidence UI proves what was collected, who touched it, and that it was not altered—critical for IR, legal, and compliance. Design an evidence locker with artifact types, hash verification, and access controls; a chain of custody log for every transfer and view; legal hold flags that block deletion; and export packs aligned with compliance exports and investigation cases. Start from the Figma guides hub and pair with audit log, data retention, war room, and Dev Mode handoff.
Who this is for
- Product designers building incident response evidence stores, digital forensics workflows, and legal-hold surfaces for enterprise Security and GRC consoles.
- Design system teams aligning custody timeline, hash badges, and hold ribbons with badges, tables, and modals.
- Engineering teams implementing WORM storage, hash chains, RBAC on artifact download, and export manifests for regulators.
Evidence locker (case artifacts hub)
EvidenceLocker — Case INV-2026-0412
├── Header: 14 artifacts · Legal hold: Active · Retention: exempt until hold released
├── Actions: [ Add artifact ] [ Bulk verify hashes ] [ Export pack ] [ Request legal review ]
├── Filters: Type · Source · Custodian · Hold status · Redaction level
└── Row: disk-image-acme-laptop-0412.e01 · Hash SHA-256 verified · Custodian: Ana Liu · Added 2026-07-24 4:12 PM| Column | Content |
|---|---|
| Artifact ID | Immutable system ID + human label |
| Type | Disk image, memory dump, log export, screenshot, email, PCAP, document |
| Source | Host, user, cloud bucket—link SIEM query snapshot |
| Hash | SHA-256 / MD5 display; verified badge or mismatch alert |
| Custodian | Current responsible analyst |
| Hold | None / Case hold / Org-wide legal hold |
| Size / retention | Storage class; deletion date unless held |
Verdict: locker is append-only for analysts—delete requires legal + admin workflow with audit.
Intake from investigation workspace “Save to evidence” creates artifact row with query snapshot metadata.
Artifact intake wizard
AddArtifactWizard
├── Step 1: Type — Log export · Disk image · Screenshot · Network capture · Other
├── Step 2: Source — Upload file · Link cloud object · Pull from SIEM export job
├── Step 3: Metadata — Description · Related entity (user/IP/host) · Classification label
├── Step 4: Hash — Auto-compute on upload · [ Verify against source manifest ]
├── Step 5: Custody — Assign custodian · Notify legal if PII threshold exceeded
└── [ Add to locker ] · Immutable after submit| Step | UI detail |
|---|---|
| Upload progress | Chunked upload with resume; progress bar |
| Hash compute | Show algorithm; mismatch blocks submit |
| Classification | Sensitivity labels drive download RBAC |
| PII scan | Warn before add; suggest redacted derivative artifact |
| Source link | SIEM job ID, EDR collection ID—traceable provenance |
| Duplicate detect | Same hash → link existing artifact instead of re-upload |
Use file upload patterns with drag-drop and virus-scan pending state.
Large artifacts: stage to cold storage; show “Available in 15m” with notification—do not block case creation.
Chain of custody log
ChainOfCustody — Artifact EVD-8842-001
├── 2026-07-24 4:12 PM · Created · Ana Liu · Intake from upload · Hash: abc123…
├── 2026-07-24 4:45 PM · Viewed · Marcus Chen · Preview metadata only (no download)
├── 2026-07-25 9:00 AM · Custody transfer · Ana Liu → Legal team · Reason: External counsel review
├── 2026-07-25 9:01 AM · Download · Sarah Kim (Legal) · Watermarked PDF · IP: 203.0.113.10
└── 2026-07-25 11:30 AM · Hash reverified · System · Scheduled integrity check · Pass| Event type | Logged fields |
|---|---|
| Created | Actor, source, initial hash |
| Viewed | Actor, view mode (metadata vs full) |
| Downloaded | Actor, format, watermark ID, IP, purpose code |
| Transferred | From/to custodian, reason, approver if required |
| Exported | Pack ID, recipient, manifest hash |
| Reverified | Scheduled or manual hash check result |
| Hold applied | Hold ID, scope, releasing authority |
Timeline uses vertical stepper—mirror audit log visual language for consistency.
Non-repudiation: custody entries cannot be edited or deleted—corrections add new “Amendment” event with reference.
Custody transfer workflow
CustodyTransfer
├── Artifact: EVD-8842-001 · disk-image-acme-laptop-0412.e01
├── From: Ana Liu · To: External forensics vendor · Contract: MSA-2024-IR
├── Reason: Deep malware analysis · Required by: 2026-07-26
├── Approvals: IR lead (required) · Legal (required for external)
├── Transfer method: Secure portal link · Expires 72h · Download once
└── [ Initiate transfer ] · Custody updates on vendor ack| Control | Purpose |
|---|---|
| Internal vs external | External requires legal approval step |
| Time-limited link | Expiring portal URL with access log |
| Vendor ack | Recipient must accept custody—timestamp recorded |
| Return path | Vendor uploads derivative report as new linked artifact |
| Break-glass | Emergency transfer with post-hoc review flag |
Pair with vendor risk—block transfer to unapproved vendors.
Use modals for approval gates; forms for reason codes.
Legal hold and retention overlay
LegalHoldOverlay
├── Case INV-2026-0412 · Hold ID: LH-2026-089 · Applied 2026-07-24
├── Scope: All artifacts in locker + related SIEM snapshots + audit excerpts
├── Blocks: Auto-deletion · Custodian transfer without legal ack · Bulk export to non-approved destinations
├── Release: Requires Legal + Compliance dual approval · Documented reason
└── Link: [Compliance export job](/designing-compliance-exports-and-legal-hold-ui-in-figma/) · [Data retention policy exception](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)| State | UI treatment |
|---|---|
| Hold active | Ribbon on locker header; amber badge on each artifact |
| Pending release | Review queue for legal team |
| Org-wide hold | Supersedes case hold—blocks all matching artifacts |
| Retention countdown | Hidden while held; shows projected date after release |
War room from shift handover can trigger provisional hold—legal confirms within 24h or hold auto-expires with alert.
Export pack builder
ExportPackBuilder
├── Case: INV-2026-0412 · Recipient: Regulator inquiry REF-2026-441
├── Selected artifacts: 8 of 14 · Redacted derivatives included where required
├── Manifest: File list + hashes + custody summary PDF
├── Encryption: PGP key fingerprint · Password delivery separate channel
├── Approval: Legal (required) · Compliance officer (required)
└── [ Generate pack ] · New custody event on completion| Component | Detail |
|---|---|
| Manifest JSON | Machine-readable list with hashes |
| Custody summary | Human-readable chain PDF |
| Redaction map | Which fields removed per artifact |
| Watermark | Recipient name + export ID on every PDF |
| Expiry | Download link TTL; re-request needs new approval |
Align pack structure with compliance exports—reuse manifest schema where possible.
Partial export: regulator asks for logs only—select type filter, not full locker dump.
Integrity monitoring dashboard
| Check | Frequency | UI on failure |
|---|---|---|
| Hash reverification | Daily on hot storage | Red banner on artifact row |
| Storage replication | Continuous | Degraded badge; block download until healthy |
| Access anomaly | Real-time | Alert via security alerting |
| Custodian inactive | Weekly | Prompt reassign if custodian offboarded |
| Hold without case owner | Daily | Notify war room commander |
Surface integrity status on posture dashboard—“Evidence integrity: 100% verified last 7d.”
Link member offboarding—auto-reassign artifacts when custodian leaves org.
Prebuilt artifact templates
| Template | Typical source | Pairs with |
|---|---|---|
| Auth log export | SIEM saved search | Threat hunting |
| EDR disk image | Endpoint agent | Threat intel IOC |
| WAF request sample | Edge logs | Automation run |
| Member complaint email | Support forward | Suspicious login recovery |
| Admin action screenshot | Manual capture | Audit log |
| PCAP slice | Network tap | SIEM connectors |
| Runbook execution log | IR platform | Incident runbooks |
Template gallery uses cards with required metadata fields pre-filled.
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Download without custody log | Chain breaks in court | Log every download with actor and purpose |
| Editable custody history | Evidence challenged | Append-only log with amendment entries |
| Same access for view and export | Over-exposure of PII | Separate permissions per action |
| No hash on intake | Integrity unprovable | Block submit until hash computed |
| Legal hold as afterthought | Auto-deletion destroys proof | Hold toggle on case creation for Sev 1 |
| Artifacts outside case | Orphan evidence | Locker scoped to investigation ID |
| External transfer without vendor gate | Data leaves to untrusted party | Vendor approval + expiring links |
| Watermark missing on PDF | Leak untraceable | Recipient + export ID on every page |
| No integrity reverification | Silent bit rot | Scheduled hash checks with alerts |
| Export pack without manifest | Regulator rejects submission | Standard manifest + custody summary |
Recommended workflow
- Design evidence locker with types, hashes, custodian, and hold ribbons.
- Build intake wizard with upload, hash verify, classification, and duplicate detection.
- Implement chain of custody timeline for create, view, download, transfer, export.
- Add custody transfer approvals for internal and external recipients.
- Wire legal hold to retention, deletion blocks, and compliance export packs.
- Document RBAC, watermark, and manifest schema in Dev Mode.
FAQ
Evidence locker vs investigation notes?
Notes are analyst narrative; locker stores immutable files and exports with cryptographic integrity proof.
Chain of custody vs audit log?
Audit log covers all org security events; custody log is artifact-specific legal chain—subset with stricter immutability rules.
Can analysts delete mistaken uploads?
No direct delete—mark as “Superseded” with link to replacement artifact; original remains with custody entry.
Legal hold vs data retention policy?
Retention sets default lifecycle; legal hold pauses deletion regardless of retention until explicitly released.
Export to compliance export job?
Yes—case export pack can spawn org-wide compliance job when scope exceeds single incident.
Next steps
- Design compliance exports and legal hold UI in Figma — org-wide hold and regulator export jobs
- Design threat hunting queries and investigation workspace UI in Figma — source of query snapshots saved to locker
- Design security operations shift handover and war room UI in Figma — trigger holds and assign custodians during active IR
- Design audit log and security activity UI in Figma — shared timeline language for custody events
- Design data retention policies and auto-deletion UI in Figma — default lifecycle overridden by hold
§ Keep reading