eDiscovery has transformed the way legal teams manage large, complex information sets. Its phases - collection, preservation, processing, search, review and disclosure - and the practices associated with them, now routinely also underpin criminal investigations. That structure and discipline are largely beneficial. But there is a significant risk that is easy to miss when an investigation is viewed through a discovery or disclosure lens: the document can become the centre of gravity.
In an investigation, the critical unit is often not the document at all. It may be a fact, a transaction, a person, an event, a relationship or an assertion drawn from several different sources. The investigator’s task is to work out what happened and why. That requires more than preserving, organising and identifying relevant material. It requires being able to trace how an evidential proposition came to exist.
Consider a simple example: a transaction is extracted from a bank statement. A name is matched to an entity appearing elsewhere in the evidence. Communications are linked to that entity. A chronology is built. An analytical tool identifies a pattern. An investigator reaches a conclusion.
The original material may have been preserved perfectly. But that is only part of the evidential story.
Can we trace the conclusion back through each step? Can we distinguish what was observed in source material from what was extracted, normalised, linked, derived through analysis or inferred by a person? Can we see what happened to the information along the way?
That is the role of provenance. Importantly, the provenance at issue here is not simply the technical provenance of an item of evidence. It is also the provenance of the facts and factual assertions drawn from it. Establishing that a message was recovered from a particular phone, for example, does not by itself establish that the accused created the message. If that factual assertion is made, what is the basis for it? What evidence supports the attribution? Was specialist expertise required to reach the conclusion, and what technical information or analysis did that expert rely upon? Provenance allows those assertions, and the reasoning that supports them, to be traced back to their evidential foundation.
Chain of custody remains essential. It protects the integrity and handling of evidence. Provenance addresses a related but broader question: where did this particular piece of information come from, what happened to it, and what processes of analysis or verification led to it becoming something we can now rely on?
This is fundamentally a question of defensibility.
That matters in any investigation, but particularly in criminal proceedings, where the prosecution carries the burden of proving its case beyond reasonable doubt and the consequences of error are profound. The increasing prevalence of electronic evidence also means that more of the evidential story may depend on extraction, transformation, automated analysis and the interpretation of data rather than on a single, self-contained document.
Each additional step creates another point at which the integrity, reliability or methodology underpinning a finding may be tested. That makes provenance increasingly important as investigative technology grows more sophisticated.
AI-assisted review, entity resolution, automated chronologies, relationship analysis and pattern detection can help investigators find meaning in evidence at a scale that would otherwise be impossible. But their value depends on whether the resulting outputs can be tested and explained. An insight that cannot be traced back to its evidential foundation is inherently harder to defend when a finding is challenged.
This is where investigation and discovery begin to diverge.
Discovery is concerned with identifying, managing, reviewing and ultimately disclosing relevant material. Investigation has an additional task: building and testing an account of what happened in a way that can ultimately withstand scrutiny.
That makes provenance more than a technical control. It is part of the reasoning architecture of a defensible investigation.
The more sophisticated our investigative tools become, the more important provenance becomes. As our tools get better at telling us what the evidence may mean, we need to be equally good at showing how we got there.