Scope and Relevance

Begin by clarifying the issues under review and the specific facts needed to determine what occurred. Relevant evidence directly relates to those facts and helps establish what happened. Avoid collecting information that is not tied to the case, as it may distract the investigation and raise privacy concerns. Focus on verifiable material and ensure that sources are credible and accessible.

Sources of Evidence

Key sources include documents such as policies, incident reports, emails, calendars, logs, and dashboards. Digital communications from messaging platforms or collaboration tools can also provide context. Physical records should be preserved with care to prevent loss or alteration.

Privacy and Consent

Respect applicable privacy rules when collecting personal information. Gather data only as necessary for the investigation, and document the purpose and authority for access to each item. Avoid exposure of unrelated confidential information.

Initial Collection Steps

Collect items in their original form where possible. Create copies for analysis while maintaining the original intact. Record the source, time, custody holder, and any limitations or conditions on use of each item.