Overview#
During a complex financial crime prosecution, a spreadsheet in evidence has been through several hands: extracted from a seized server by a forensic examiner, reviewed by an analyst, shared with an external accountancy expert, redacted for disclosure, and ultimately submitted to court. At any point in those proceedings, a party might ask: who touched this file, when, what did they do to it, and how does the version in court relate to what was originally seized? Provenance tracking answers all of those questions without ambiguity.
The Evidence Provenance Tracking module creates a forensic-grade audit trail documenting every interaction with evidence from initial collection through final disposition. Source tracking records where evidence came from and how it was collected. Modification history captures every change with the acting user's identity and a precise timestamp. Access logs cover every view and retrieval, not only writes. Derivative tracking links every processed output back to the master file so the relationship between original and derived material is always clear. Prosecutors, defence teams, courts, and compliance officers across criminal investigation units, financial regulators, and coroner services all rely on this record.
Key Features#
- Complete source tracking documenting evidence origin, collection context, collection method, and responsible officer at the point of ingestion
- Modification history recording every change with the acting user's identity and a precise timestamp, covering annotations, metadata edits, and file modifications
- Access logs tracking all evidence views and retrievals, not only write operations, to produce a full picture of who engaged with each item and when
- Derivative tracking linking every processed output, transcript, thumbnail, and redacted version to the original master evidence file
- Forensic-grade audit trails meeting legal admissibility standards for Irish courts and other jurisdictions
- Fast query performance for provenance lookups, even across large investigations with thousands of related items
- Full lineage visualisation from source evidence through all transformations, derivatives, and custody transfers in a single view
- Integration with chain of custody for a unified evidence history combining both provenance and custody records
Use Cases#
- Documenting complete evidence provenance from collection through all processing, transformation, and disclosure steps for court presentation
- Tracking who accessed evidence and when, supporting compliance monitoring and internal investigation of evidence handling
- Linking derivative evidence (transcripts, OCR text, redacted versions, thumbnails) back to original source files to confirm the relationship is unbroken
- Generating provenance reports for court proceedings that demonstrate integrity and handling transparency throughout the evidence lifecycle
Integration#
The Evidence Provenance Tracking module connects with evidence management, chain of custody, and compliance reporting systems.
Open Standards#
- W3C PROV-DM (Provenance Data Model): The module's data model follows the W3C PROV-DM Recommendation, mapping every provenance record to entity, activity, and agent nodes connected by the five canonical PROV-DM relationships covering generation, attribution, association, derivation, and communication.
- W3C PROV-JSON and PROV-O: Provenance chains are exportable as W3C PROV-JSON and as PROV-O JSON-LD using the W3C PROV ontology, enabling interoperability with any compliant provenance consumer or court-disclosure toolchain.
- RFC 8785 (JSON Canonicalisation Scheme, JCS): Every record's signing payload is serialised using JCS deterministic canonical JSON so that signatures remain reproducible across language runtimes and can be independently verified offline.
- FIPS 180-4 (SHA-256): SHA-256 is used for evidence content hashing, chain-of-custody state hashes, and as the hash function in the Merkle tree that roots each provenance transcript, providing tamper evidence that courts can verify independently.
- FIPS 204 / ML-DSA-65 (CRYSTALS-Dilithium3): Post-quantum digital signatures over provenance records are supported via ML-DSA-65, protecting the long-term integrity of evidence records against future quantum-capable adversaries across the full evidence lifecycle.
- RFC 8032 (Ed25519): Chain-of-custody entries are individually signed with Ed25519 Edwards-curve digital signatures, producing compact, high-assurance tamper-evident entries that satisfy legal admissibility requirements without key-management overhead.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14