chain of custody
termgovernance & risksecurity
The unbroken record of who held evidence, when, and what they did with it.
Its purpose is to make an answer defensible rather than merely correct: an investigator who cannot show the evidence was protected from alteration has findings that can be dismissed without being disproved. In practice it is unglamorous - hashes taken at acquisition, copies worked on rather than originals, timestamps, signatures and a log of every transfer. It matters outside courtrooms because the same discipline is what makes an internal incident report survive contact with a vendor, an insurer or a regulator.
Also known as: custodia