# File Provenance ## Identification File provenance records a file's origin, producing application, transformations, custody, timestamps, container context, and verification history. ## Notebook evidence PDF pages 5–9 of [[Scanned_20260730-1806]] catalogue extensions across audio, graphics, firmware, archives, spreadsheets, games, registry hives, and filesystems. Several copied associations are ambiguous or incorrect, demonstrating that a suffix is a lead rather than a reliable identity. ## Evidence to preserve Original path and filename, hashes, magic bytes, MIME result, container structure, filesystem metadata, timestamps with timezone, originating application, acquisition method, and any conversion or rename history. ## Relationships [[Technical Continuity]] · [[Package Provenance]] · [[Windows Registry Hive]] · [[Hierarchical File System]].