Evidence Provenance and Working Copies in a Private Investigation

Investigators work with copies all the time.

A client emails a photograph. A witness forwards a PDF. A scanned document is turned into searchable text. A photograph is cropped for a report. A video clip is extracted from a longer recording. A document is redacted before it is shown during an interview.

None of that is unusual.

The problem begins when the case file can no longer answer two basic questions:

Where did this item come from?

and

Is this the same version that originally entered the investigation?

That is where provenance and working-copy discipline matter.

Provenance is the story of the evidence

In practical case management, provenance means keeping enough information to understand the origin and history of an item.

Who supplied it?

When was it received?

How was it received?

What was the original filename or identifying information?

Was it downloaded from a system, scanned from paper, photographed by the investigator, emailed by a client or obtained from another source?

Was it already a copy when the investigator received it?

Not every piece of evidence will have a perfect history.

The point is to preserve what is actually known rather than allowing the source to become a guess later.

“Original” needs careful language

Investigators often use the word original casually.

With paper evidence, the distinction may be relatively straightforward: there may be a physical original and one or more copies.

Digital evidence is different.

A file received by email may be the exact file the sender possessed, but that does not necessarily make it the first or only version ever created. A downloaded photograph may have been exported from another system. A screenshot is a newly created image of information displayed somewhere else.

For ordinary case management, a safer concept is often the item as originally received or acquired by the investigator.

That is the version you can actually preserve and describe.

Do not claim more provenance than you have.

Preserve the received source before editing

Once an important digital item enters the case, preserve the received version before doing anything that changes it.

That means the photograph you received should remain available before it is cropped.

The scanned PDF should remain available before OCR or compression.

The video should remain available before a short clip is extracted.

The spreadsheet should remain available before selected rows are exported for a report.

The source and the working copy serve different purposes.

The source preserves what entered the investigation.

The working copy helps the investigator do the work.

Keeping both is not unnecessary duplication. It is what allows the investigator to explain later what changed and what did not.

Give working copies a reason for existing

A working copy should exist because there was a practical need for it.

Examples include:

• OCR to make a scanned document searchable;
• rotation or deskewing for readability;
• redaction to protect information that should not be disclosed;
• annotation to point out a relevant feature;
• conversion to a format that can be reviewed;
• enhancement for examination;
• extraction of a relevant section from a larger file; or
• preparation of an exhibit for an interview or report.

The case record does not necessarily need a paragraph explaining every routine conversion.

But it should be possible to determine that the derivative is not the received source and, where the distinction matters, why it was created.

Do not let filenames carry the whole burden

A file called IMG_2184-CROPPED-FINAL2.jpg tells you something.

It does not tell you enough.

Filenames change. People rename things. Files are copied between folders. “Final” develops a habit of becoming “final-new,” then “final-revised.”

Important evidence should have an identity in the case record that does not depend entirely on whatever filename happened to survive.

A stable evidence identifier, source description, acquisition date and relationship between source and derivative make the record much easier to understand later.

Hashes can help identify digital files

For significant digital evidence, a cryptographic hash can provide another useful piece of identification.

NIST describes a hash value as a value that can help substantiate the integrity of digital evidence. NIST's digital-evidence preservation guidance also recommends documenting the original source of digital files and notes that digital files are easy to change.

A hash is useful because changing the digital data changes the resulting hash value.

That makes it possible to compare a file later with the version previously recorded.

But the limitations matter.

A matching hash does not prove that the information inside the file is true.

It does not prove who created the file.

It does not prove that the file was lawfully obtained.

It helps answer a narrower question: is this digital file the same data that was identified earlier?

That is valuable, but it should not be exaggerated.

A derivative should point back to its source

Suppose an investigator receives a 60-page PDF and creates a three-page excerpt for an interview.

Months later, the file should not contain only the excerpt with no indication of where it came from.

The relationship should remain visible:

Interview exhibit → extracted pages → source PDF → provider/acquisition record

The same principle applies to photographs, audio clips, exported messages and redacted copies.

The derivative should not become an orphan.

Redaction creates a new version

Redaction deserves particular care because it intentionally changes what another person can see.

The unredacted source may need restricted handling because it contains sensitive information.

The redacted copy may be entirely appropriate for disclosure, interview use or reporting.

But they should not be confused.

Keep the source secure.

Identify the redacted version as a derivative.

And, where important, record why the redaction was made.

That allows the investigator to use information responsibly without losing the original record.

Enhancement should clarify, not create

Investigators sometimes need to improve the reviewability of an image, recording or scanned document.

Brightness may be adjusted. An image may be enlarged. Audio may be processed for easier listening. A scan may be sharpened or deskewed.

Again, the issue is not whether those steps are allowed.

The issue is whether the case record makes clear that the investigator is looking at a processed version.

A derivative should help examine the evidence, not quietly replace it.

Where enhancement could affect interpretation, preserve the settings, method or explanatory note needed to understand what was done.

Screenshots need provenance too

Screenshots are common because they are fast and convenient.

They are also easy to separate from context.

A screenshot of a social-media post may not show the account URL, date collected, surrounding comments or whether the content was visible publicly or through an authenticated account.

A screenshot of a text conversation may omit earlier messages.

A screenshot of a webpage may preserve only what was visible at one moment.

That does not make screenshots worthless.

It means the investigator should record enough acquisition context to understand what the screenshot represents.

Where the surrounding source can also be preserved appropriately, do so.

Copies can have different evidentiary value

Two files that look identical may have different histories.

A PDF supplied directly by the issuing organization and the same-looking PDF downloaded from an unknown file-sharing site are not necessarily equivalent from an investigative standpoint.

The visible content may be the same.

The provenance is not.

That is why source information belongs with the evidence rather than being treated as an optional note.

Keep the record proportionate

Not every attachment in every private investigation needs full forensic handling.

A routine publicly available brochure does not necessarily need the same documentation as a critical surveillance video or disputed digital record.

The level of control should be proportionate to the importance of the item, the assignment, the likelihood that authenticity or handling will matter, and any applicable legal or contractual requirements.

Good evidence management is not about turning every case into a digital-forensics laboratory.

It is about being able to explain your own record.

The test is whether you can reconstruct the evidence history

Pick an important item from a closed case and ask:

Where did it come from?

When did it enter the investigation?

Is the received version still available?

Were any working copies created?

What was changed in those copies?

Can the derivative be traced back to the source?

If a hash or other integrity information was recorded, can it still be associated with the correct file?

And can you explain which version was used in the final report?

If the answer is yes, the case file has preserved more than a document.

It has preserved the document's place in the investigation.

That is provenance.

And in a complicated case, it can be the difference between merely having the evidence and being able to explain it.