home/glossary/Chain of Evidence

Chain of Evidence

nounid 1791·updated May 9, 2026
candidate

A process and record that shows who obtained the evidence; where and when the evidence was obtained; who secured the evidence; and who had control or possession of the evidence. The “sequencing” of the chain of evidence follows this order: collection and identification; analysis; storage; preservation; presentation in court; return to owner.

MWE

Classifications

Entity Type

Process95%llm-generatedllm:claude-haiku-4-5

Sensitivity

Regulated90%llm-generatedllm:claude-haiku-4-5

Information Class

Cui70%llm-generatedllm:claude-haiku-4-5

Variants

possessive
Chain of Evidence's

Framework definitions

NISTIR 7298: Glossary of Key Information Security Terms, Revision 21 senseview framework →
§1
A process and record that shows who obtained the evidence; where and when the evidence was obtained; who secured the evidence; and who had control or possession of the evidence. The “sequencing” of the chain of evidence follows this order: collection and identification; analysis; storage; preservation; presentation in court; return to owner.
CNSSI-4009 (Glossary of Information Assurance Terms)1 senseview framework →
§1
A process and record that shows who obtained the evidence; where and when the evidence was obtained; who secured the evidence; and who had control or possession of the evidence. The “sequencing” of the chain of evidence follows this order: collection and identification; analysis; storage; preservation; presentation in court; return to owner.

Outgoing relationships

No outgoing triples
This term is not the subject of any RDF-style relationship yet.

Incoming relationships

No incoming triples
No other term currently asserts a relationship to this one.