Investigation Methodology

Provenance (Evidence)

Provenance is the documented origin and history of a piece of evidence: where it was found, when it was retrieved, what it looked like at that moment and how it entered the case file. Provenance answers “where did this come from?”, while chain of custody answers “who has handled it since?”. In OSINT, provenance separates a citable finding from an unattributed claim, because a public page can change or disappear after it is retrieved. Provenance is also a common limitation: reverse image search can show where an image appears, but not who created it or where it first appeared. Nexus records provenance for each evidence record and preserves it in PDF case reports.