What it means
Evidence supports or challenges a specific claim. A record becomes useful evidence when you can explain its source, context, and limits, not simply because it appears in a security console. Separate observations from interpretation: an export event may show that an account requested a file, while a download-completion event provides different support for whether data left the system. Preserve material that contradicts your preferred explanation. Good incident notes make uncertainty visible so another person can review the decision.
AN ILLUSTRATIVE SCENARIO
Investigating an unexpected patient-record export
A clinic receives an alert about a large export. The investigator preserves the application’s original export record, the relevant access logs, and the associated account history. The records show a request from an administrative account, but not whether the requester was the assigned employee. The report states that distinction. A colleague’s recollection may guide further questions, while the preserved records support the chronology.
Put it to work
- State the question the material addresses. Collect only relevant data using an authorized method, and record the source, collector, time, and collection scope.
- Protect original material from casual alteration and work on copies. Record transfers and transformations; use hashes where appropriate to check that file bytes remain unchanged.
- Connect conclusions to specific records. Document conflicting observations and gaps, and restrict distribution when evidence includes personal information or confidential business data.
How to check your work
Ask a colleague to reproduce one conclusion using the cited evidence. They should locate the original material, understand how it was obtained, and identify both what the records support and what remains unresolved.
Connect the ideas
- Provenance
The recorded origin, collection method, transformations, and completeness limits of a piece of evidence.
- Log
A record emitted by a system that something happened, which may later be used as evidence.
- Integrity
The property that data and processes remain complete and unaltered except by authorized action.
- Incident
An event or set of events that actually or potentially causes a security loss requiring coordinated handling.