Evidence is a chain, not a folder
Create an evidence log that supports reliable findings and later review.
The move: make every evidence item answer a question. A good evidence log is not administrative polish. It is the control that keeps findings tied to reliable information. The log should tell a reviewer what the item is, where it came from, how it was preserved, why it matters, and what it cannot prove. Source Original system records usually carry more weight than screenshots, summaries, or forwarded files. Record the system, custodian, date range, and who extracted it. Link Every item should connect to an investigation question or finding. If it does not, it may still be useful background, but…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in