Ordered evidence entries
Each entry identifies one file through its hash and records a timestamp and a link to the preceding entry. The first file starts the sequence because no earlier evidence entry exists. Later entries depend on the chain position before them, so processing the same files in a different order produces a different chain record.