Reading standard
Statements about misconduct, motive, identity, conspiracy, retaliation, information access, or responsibility should be read according to their stated evidence basis. Original sources control over summaries.
Preservation before interpretation
Original evidence should be preserved before it is annotated, converted, compressed, redacted, or summarized. Working copies can be created for review, but the original should remain unchanged.
Digital communications and devices
- Native message exports and complete threads.
- Original photographs and video with metadata intact.
- Device backups, cloud backups, account exports, and relevant security logs.
- Original audio files and recording metadata.
- File hashes where forensic preservation becomes relevant.
- Transmission history, filenames, creation and modification timestamps, and source device information.
Government and agency records
- Case-management entries and audit histories.
- User-level access logs and reason codes.
- Source registration, handler, tasking, approvals, debriefs, and payments where applicable.
- Referral histories, routing, supervisor review, duty records, and dissemination logs.
- FOIA/Privacy Act processing notes, search histories, preservation flags, and appeal records.
- Provider legal-process files and agency returns.
Provider and third-party records
- Account login and access histories where available.
- Legal process, emergency requests, subpoenas, warrants, productions, and notices.
- Hotel CCTV, access, reservation, and incident records where relevant.
- Travel and location records tied to specific investigative questions.
- Business and financial records only where a specific legal element or causation issue makes them relevant.
Witness preservation
Witness development should separate what the witness personally observed, what I told the witness, what the witness heard from another person, and what the witness inferred later. Neutral questions should come before leading questions. The witness's own words should be preserved whenever possible.
Why preservation is not proof
A preservation demand does not mean the requested records exist or that they contain evidence of wrongdoing. Preservation protects the possibility of later review. It is an evidence-integrity step, not a finding.
Chain of custody
When a file becomes important enough for forensic or litigation use, record where it came from, who handled it, whether it was copied, the hash if appropriate, and every transformation applied to a working copy. Do not overwrite originals with annotations.