# Evidence Chain of Custody Template

## Evidence Handling Rules

- Store evidence under `_rtexit-output/docs/evidence/`.
- Redact secrets, credentials, PII, and client confidential values.
- Hash files with SHA-256 where practical.
- Keep original timestamps.
- Reference evidence from findings using relative paths.

## Chain of Custody

| Timestamp | Evidence ID | Finding | File/Location | SHA-256 | Handler | Action | Notes |
|---|---|---|---|---|---|---|---|
| [time] | E-001 | F-001 | evidence/... | [hash] | [name] | created | [notes] |

## Evidence Types

| Type | Storage Path | Notes |
|---|---|---|
| Screenshot | evidence/screenshots/ | Redact sensitive content. |
| Terminal Log | evidence/terminal-logs/ | Include command context. |
| HTTP Log | evidence/http-logs/ | Redact tokens. |
| Artifact | evidence/artifacts/ | Hash before and after transfer. |

## Integrity Verification

```bash
Get-FileHash .\_rtexit-output\docs\evidence\[file] -Algorithm SHA256
```

