Chain of custody
A documented record of who collected, handled, transferred and stored each piece of evidence, proving it was not altered.
For each evidence item (disk image, memory dump, log export) the chain of custody records what it is, its hash at collection, who collected it, when, how, and every subsequent transfer and access. Evidence is stored read-only or write-once, and hashes are re-verified before analysis.
It matters whenever an incident might reach court, a regulator, insurers or an employment tribunal; a gap lets the other side argue tampering. In cloud and large-scale DFIR, engineering makes this automatic: collection tools that hash and log on acquisition, object storage with object lock, and access-logged evidence buckets. Legal hold is the related obligation to preserve relevant data once litigation is anticipated.