During discovery sharing, an audit log must record the sharing user's identity, the recipient's email address, exact file IDs shared, expiration timestamps, access permissions granted, and the precise moment the recipient opened or downloaded the files.

No, because in a CJIS compliant Digital Evidence Management System, audit logs are immutable. They're stored in a write-once secure environment that not even system administrators can edit or delete from, in order to preserve court admissibility.

A generic IT system log tracks general software performance, server uptime, and system errors. An audit log is far more specific: it records every human and automated interaction with evidentiary assets, user IDs, file actions, cryptographic hash checks, and chain of custody transfers, in a level of detail that court proceedings demand.

A cryptographic hash (such as SHA-256) creates a unique digital fingerprint for a file at the moment of intake. The audit log records this baseline hash and recalculates it during subsequent file operations or exports. If the original and recalculated hash values match across audit log entries, it provides mathematical proof in court that the file remained untouched and uncorrupted throughout its lifecycle.

When physical or digital evidence reaches its final retention date and is purged according to statutory requirements, digital files are permanently deleted and physical items undergo formal destruction or disposal, while their corresponding audit trails are maintained permanently. In addition, the audit trail permanently records the event and action taken—including the authorized officer who ordered the purge and any governing court order if the purging was judicially mandated.