Chain of custody plays very  important role in digital forensic investigation process. To prove chain of custody, investigators must know all details on how the evidence was handled every step of the way. „Five WS (and one H) “must be applied.  Life cycle of digital evidence is very complex, and at each stage there is more impact that can violate a chain of custody. Proper chain of custody must include information on how evidence is collected, transported, analyzed, preserved, and handled with. In this paper will be presents a framework which can im(prove) chain of custody of digital evidence in all stages of digital investigation process.