Evidence makes a technical decision reconstructable. It should show what happened, under which identity, at what time and with what impact, without collecting more sensitive information than necessary.
Minimum sufficient evidence
Capture the observed condition, context and result. An isolated screenshot is usually less useful than a short sequence with timestamps and an explanation.
Chain of custody
Assign identifiers, record who obtains each item and preserve its integrity. Keep raw data separate from copies used for analysis.
Reduction and retention
Define from the start how long evidence is retained and how it is destroyed. Secrets, personal data and access artefacts require more restrictive handling.