A device obtains previously created data content. The device unmasks and extracts one or more chain of custody blocks stored in association with the data content. The one or more chain of custody blocks includes chain of custody data identifying who, when, where, and, with what hardware and/or software, created or edited the data content. The device analyzes the one or more chain of custody blocks and validates an origination of the data content based on the analysis of the one or more chain of custody blocks.