How to Organize Evidence in a Complex Investigation

Download

Download the evidence-log template (CSV)

Start with provenance

Before you organize anything, capture where it came from: who produced it, when, and through what channel. A photograph found on a public website and a photograph provided by a witness have very different standing. Provenance is the difference between a record you can rely on and one you cannot yet evaluate.

Give every item a stable identifier and metadata

Assign each item a stable, unique identifier and attach the same metadata fields to everything. Consistency is what makes a large collection searchable later. The fields that matter most: identifier, description, source, date obtained, custodian, format, and status (e.g., received, reviewed, verified, disputed, redacted).

Maintain a chain of custody

Record who has held the item and when, and make that record append-only. In a formal investigation, chain of custody is what makes evidence admissible; in research and journalism it is what makes your work defensible. If custody cannot be reconstructed, the item is weaker than it looks — and you should say so.

Index for retrieval

A pile of well-labeled items is still hard to use unless you can find them. Index by the dimensions you actually query: people and entities, places, dates, and the claims or events an item supports. The same item may be reachable from several angles — a document that places a person at a location also supports a timeline entry.

Keep originals immutable

Store originals as they arrived and never edit them in place. When you redact, transcribe, or translate, save the result as a derived item that points back to its original. Content-addressing (hashing the bytes) gives you a cheap, strong guarantee that nothing changed underneath you.

Separate facts from commentary

Keep the evidentiary record distinct from your own analysis. An item is what it is; what it means is a separate layer. If you let interpretation creep into the evidence record, you will eventually mistake your own theory for the thing the evidence actually shows.

Handle redaction and privacy

Mark items that contain personal information and redact before sharing or publishing. Review exports before they leave your hands. A single unredacted address or phone number can cause real harm to a real person — treat sensitive material as sensitive by default.

Retention and deletion

Know why you are keeping something and for how long. Respect the lawful basis for the material you hold, honor consent and deletion requests where they apply, and do not retain material you have no legitimate reason to keep. Organized does not mean retained forever without purpose.

Sources & further reading

• National Institute of Justice (NIJ) — guidance on evidence handling, preservation, and forensic science in investigations.
• Society of Professional Journalists Code of Ethics — standards for accuracy, sourcing, and minimizing harm in reported work.