# Evidence Collection and Chain of Custody

Incident ID: __________  Evidence ID: __________

## Collection

- Description and relevance:
- Source system / tenant / account:
- Source location:
- Collector:
- Collection start and end (UTC):
- Acquisition method and commands:
- Tool and version:
- Original filename / object identifier:
- Size:
- SHA-256:
- Destination and access controls:
- Encryption / key custodian:
- Collection limitations or system changes introduced:

## Transfers

| Released by | Received by | UTC time | Purpose | From / to | Integrity verified | Signature / approval |
|---|---|---|---|---|---|---|
| | | | | | | |

## Disposition

- Retention requirement:
- Legal hold:
- Authorized disposition:
- Disposition date and method:
- Approver: