The language of investigations, defined.
Plain definitions of the terms that come up across investigations, evidence, risk and compliance.
Audit trail
A chronological, ideally immutable record of every action taken in a system, who took it and when. In investigations it is what makes findings defensible.
Related: Tamper-evident · Chain of custody
Chain of custody
The documented, unbroken record of everyone who handled a piece of evidence, when, and what they did. Essential to proving evidence is authentic and unaltered.
Related: Evidence integrity · Legal hold
Data residency
The requirement that data is stored and processed within a specific country or region, for legal or sovereignty reasons.
Related: Sovereignty
Defensibility
The property of an investigation being able to withstand scrutiny: a complete, verifiable record of what was found and how.
Related: Audit trail · Chain of custody
E-discovery
The process of identifying, collecting and producing electronic information for litigation. A different, heavier discipline than internal investigation case management.
Evidence integrity
Assurance that a piece of evidence has not been altered since collection, typically proven with cryptographic hashing.
Related: Chain of custody · Hashing
Hashing
Producing a fixed-length cryptographic fingerprint of a file. If the file changes, the hash changes, making tampering detectable.
Related: Evidence integrity · Tamper-evident
Insider threat
Risk to an organisation originating from someone inside it: an employee, contractor or partner with legitimate access.
Related: UEBA · Least privilege
Least privilege
The principle that people should have only the access they need for their role, scoped to need-to-know, with everything else denied by default.
Related: Role-based access · Insider threat
Legal hold
A directive to preserve information relevant to a matter, preventing its deletion or disposal while the matter is active.
Related: Chain of custody · Retention policy
Retention policy
Rules that determine how long different kinds of data are kept and when they are disposed of, to stay lawful by default.
Related: Legal hold · Data residency
Role-based access
An access model where permissions are attached to roles rather than individuals, scoped to the case and need-to-know.
Related: Least privilege
Tamper-evident
A record designed so that any alteration is detectable, for example an append-only log where each entry is hash-chained to the previous one.
Related: Audit trail · Hashing
UEBA
User and entity behaviour analytics. An approach that models normal behaviour and flags deviations that may indicate risk, used to prioritise investigations.
Related: Insider threat