Evidence Preservation Checklist

Core idea

Evidence must be preserved so it holds up when handed to law enforcement or lawyers. Get the basics right consistently.

Components

• Hash files and keep a proper record of them.
• Capture full screenshots, including the timestamp and full context, not cropped fragments.
• Understand the legal framework and jurisdiction you operate in, which differs by country.
• Understand the downstream impact of your report before handing it over.

When to use

Throughout a case, every time you capture or store a piece of evidence, and before any handover.

Related

Handover Reports Must Be Replicable, Investigator OPSEC Checklist