Chain of custody

Evidence is only as good as the record of who held it and whether it could have been altered.

If that record is incomplete, the findings may be true and still useless in a dispute, a claim or a prosecution. It sounds like a legal formality until the moment it matters, at which point it cannot be recreated. The discipline is unglamorous: log who took what, when, and how it was stored, from the first hour.

Checked against the primary source.

More on Incident response