Evidence handling and chain of custody
Upload, verify and download evidence with proof it has not changed.
Last updated
Adding evidence
In the case workspace use the Evidence card. Staff need the evidence upload permission. Each file can be up to 25 MB.
What the system does
- Checks the extension against the real content, and refuses executables, archives, HTML and SVG.
- Scans the file.
- Records a fingerprint of the file.
- Encrypts it at rest.
- Writes a chain-of-custody entry and an audit entry.
Versions
Uploading a new version never overwrites the original. All versions are kept.
Download and verify
Every download checks the file against its recorded fingerprint. If they differ the file is not released and the event is audited. Anyone with access can also run Verify at any time. The Custody history lists every upload, view, download and check.
Note. Retention rules, legal hold and redaction are not available yet.
Related guides
Still stuck?
The SLEM Technologies team can help with set-up and questions.