Reference
Investigation and evidence terms explained clearly.
These definitions provide general orientation and should not replace legal or technical interpretation in a specific matter.
Chain of custody
A documented record of who collected, handled, transferred, stored and examined an item of potential evidence.
Corroboration
Support for a fact or account from another sufficiently independent source.
Due diligence
A risk-based examination of a person, entity, transaction or relationship before a significant decision.
Digital preservation
Steps taken to protect digital material from deletion, overwriting, alteration or loss.
Indicator
A fact or pattern that may be relevant but does not, by itself, prove the final conclusion.
Metadata
Information stored with a file or communication, such as dates, device details, authorship fields or routing data.
Open-source intelligence
Information lawfully collected from publicly available sources and analysed for a defined purpose.
Scope
The approved questions, methods, geography, time period, exclusions and deliverables of an assignment.
Threat assessment
An assessment of a potential threat actor, intent, capability, access, proximity and indicators of escalation.