Evidence becomes harder to defend when the case file records what an item says but not where it came from, how it was received, what happened to the original, or why it mattered to the investigation.
What the checklist covers
- Case reference, evidence item ID, source, provider, and date/time received.
- Neutral description and original identifying information.
- Acquisition method, location or system, original filename or label, and optional SHA-256 field.
- Initial integrity checks and documentation of damage, missing content, password protection, corruption, or incomplete exports.
- Storage and transfer information with a custody/activity table.
- Working derivatives such as OCR, enhancement, rotation, transcription, compression, conversion, annotation, or redaction.
- Relevance to the investigative question, follow-up generated, and final disposition or retention status.
Preserve the distinction between original and derivative
Review copies and derivatives can be useful, but they should remain connected to the preserved source item. The worksheet prompts the investigator to document what changed rather than allowing an edited copy to become indistinguishable from the original.
For deeper guidance, see Evidence Provenance and Working Copies and Private Investigator Evidence Management: What a Case File Should Preserve.
Record why the item matters
An evidence list is more useful when it also explains the allegation, issue, event, subject, location, timeline entry, or investigative question the item helps address. That connection makes later review and reporting easier to follow.
Keep evidence connected to the case
Investigator Professional can scan or import evidence, retain file provenance and SHA-256 information, review supported files in context, and keep case activity with the investigation record.