Record where the evidence came from, who observed it, when it existed, and how it entered the route.
Evidence must remain connected.
Capturing a record is not enough. A consequential route must prove that the evidence tested at the gate is still the same evidence that originated from the declared source.
Find the break before consequence.
Select each event. The first three preserve or describe the chain. The fourth introduces an unexplained substitution that changes what the route is actually testing.
Three rules govern the chain.
Every conversion, correction, extraction, redaction, or replacement must be explicit and attributable.
Corrections create new states. They do not erase the original HOLD, failed evidence, or prior route history.
Can you protect continuity?
Answer all three questions, then score the lesson.
1. What does continuity prove?
2. A file changes after capture, but no transformation event is recorded. What is the correct state?
3. How should a legitimate correction be handled?
Continuity is what keeps a record honest over time.
The next module moves from connection to admissibility: whether the preserved evidence is complete, relevant, fresh, sufficient, and fit for the exact consequence being considered.