With digital evidence, showing that the file has not changed since you received it matters as much as what it contains. Recording without gaps when and from whom you got it, how it was stored and what it was analysed with is called the chain of custody.
A hash is a short string computed from a file's contents; change a single character and the value is completely different. Record the SHA-256 hash as soon as you receive a file, and anyone can later check that the file submitted is the file received. Every Origma report includes the SHA-256 hash of the scanned file.
Keep the original untouched and read-only, and analyse a copy. Note when, from whom and by what route you received it — that is your chain of custody. Remember that a copy received again through a messenger has a different hash from the original and cannot be treated as the same file.
An Origma report records the analysis time and the engine and signature database versions. Running the same file through the same versions gives the same result, so the other side or a third party can re-check the analysis. Exporting a signed PDF also shows whether the report itself has changed since.
Hand over the original file, the hash record, a note on how you received it and the Origma report (signed PDF) as one package. Origma's results are probabilistic assessments, not certified forensic reports or legal proof — discuss submission and weight with a lawyer and add a certified examination if needed.
This is general guidance, not legal advice. A scan result is a probabilistic assessment, not proof.