Butler raised potential problems relating to chain of custody in relation to any potential re-visitation to the investigation by the FBI of the so-called DNC hack. You said, in essence, you didn't see how that concept could have any application to such an investigation. As I'm sure you already know, chain of custody not only has to do with "who had it" but also "who had access to it". In relation to this issue, the FBI did not verify the accuracy of computer images that were provided to them by Crowdstrike, because the only way they could have, was at a minimum, to compare the images to original data still stored on the relevant servers. It may not have even been possible for the FBI to have done so, depending on the exact date Crowdstrike provided their report to the FBI, the exact date that each server was "decommissioned", and the exact way in which each server was decommissioned (in some cases, data or partial data may still have been recoverable despite disassembly and/or erasure (depending on the manner of erasure).
In any event, even if Crowdstrike was acting in complete good faith, others had access to the servers they examined BEFORE they created their images (the hackers, at the very least), and may as well have had knowledge of the Crowdstrike investigation. In short, data on the servers may have been manipulated prior to the images being produced, perhaps to intentionally mislead Crowdstrike and/or the FBI. For anyone to have any possible opportunity to determine whether that, in fact, happened, they would need access to the servers in the same state that Crowdstrike had examined them. However, the various state of decommissioning (by Crowdstrike? or someone else on behalf of the DNC), and the fact of access to the servers by persons other than Crowdstrike, means that such an examination may either be completely without probative value, or of such insufficient reliability that findings may not meet the "beyond a reasonable doubt" standard. In Canada, a criminal court may determine not to receive such evidence at all if the the probative value is greatly outweighed by the prejudicial effect of such evidence.
That is the application of the "chain of custody" concept that I think Butler was talking about. Framed in this way, can you see the possible evidentiary issues raised by the manner in which these servers were stored (and later decommissioned) , the difficulty of establishing who had access to their data at specific points in time, and the timeline of the events of the investigation?