File provenance is the history of a file: where it originated, who created it, what systems touched it, and whether it was altered along the way. In cyber security, provenance helps answer a basic trust question: can this file be treated as the same object that left the source system?
Provenance matters because attackers often target the path a file takes, not just the file itself. A document, installer, or forensic artifact can be replaced, repackaged, or modified before it reaches a user or analysis tool. Defenders use hashes, digital signatures, metadata, and audit logs to preserve and verify provenance. In lab and incident-response workflows, strong provenance supports chain of custody and makes tampering visible, so analysts can distinguish original evidence from altered or untrusted input.