The Digital Evidence Checklist Every Private Investigator Needs

Evidence fails for one of two reasons: it was never collected properly, or it was collected properly but stored in a way that made it impossible to present effectively. The second failure is far more common than the first — and far more preventable.

This checklist is for investigators who want to ensure that evidence collected in the field survives the journey from street to submission without losing its integrity or usefulness.

Before the Job

• Case created in your management system with correct client details and instruction reference
• Permissions and legal basis confirmed — particularly for surveillance operations
• Equipment checked: storage capacity, battery, time synchronisation on all devices
• File naming convention agreed: date format, case reference, media type

During the Job

• Log entries made in real time, not reconstructed from memory afterwards
• Each observation entry includes: time, location, person observed, action observed
• Photographs and video labelled at point of capture where possible, or immediately on return
• No original files deleted in the field — bring everything back and review on a full screen

Immediately After the Job

• All media transferred from devices to case file before end of working day
• Originals preserved unmodified — any edited or cropped versions stored separately and labelled as derivatives
• Log finalised and uploaded
• Chain of custody noted: who handled the evidence and when

Before Submission

• Evidence reviewed for completeness against the original instruction
• All files checked for metadata consistency — timestamps matching log entries
• Client report prepared with explicit references to supporting evidence by filename
• Copies of everything retained in the case file after submission

The Test Every Investigator Should Apply

Before you submit anything, ask: if this evidence is challenged in eighteen months, and I am not in the room, will the file speak for itself?

If the answer is yes — if every piece of evidence is clearly labelled, correctly dated, linked to a contemporaneous log entry, and stored in a single accessible case file — your documentation will hold.

If the answer is anything other than yes, go back to the file before it leaves your hands.