Method
DFIR Evidence Provenance and Chain-of-Custody Ledger
Can evidence handling support defensible incident reconstruction?
Field scoring contract
| Field | Type | Role | Direction | Scored |
|---|---|---|---|---|
| Case / incident | text | context | context | no |
| Original preservation / acquisition method | select | evidence_signal | higher_is_better | yes |
| Hashing and integrity checks | select | evidence_signal | higher_is_better | yes |
| Custody transfer log | select | evidence_signal | higher_is_better | yes |
| Time source/timezone documentation | select | evidence_signal | higher_is_better | yes |
| Sensitive-data minimization | select | evidence_signal | higher_is_better | yes |
| Analyst notes/raw-vs-interpretation separation | select | evidence_signal | higher_is_better | yes |
Limits
- Preliminary output
- Human review required
- Not certification
- Context text is not averaged into numeric scores.
- Outputs require source/evidence review before decisions.