What is an evidence pack?

An evidence pack is the audit trail behind a root cause analysis: every query run during the investigation, every data source touched, the raw excerpts relied on, timestamps for each step, and a content hash so the bundle can be shown to be unaltered. Where the RCA report says what happened, the evidence pack shows how the investigator knows. It exists so that an auditor, a regulator, a customer or a sceptical engineer can check the work instead of trusting it. In IT operations the concept is borrowed from safety and financial audit; it is what turns a well-written incident narrative into an audit-grade artifact.