Evidence Collection, Documentation and Case File Management
Evidence Collection, Documentation and Case File Management
This domain tests whether the file you leave behind would survive scrutiny by an auditor, a regulator or a court: what was collected, when, from where, and how its integrity was preserved.
Core rules
- Evidence categories: documentary (statements, contracts, KYC records), digital (system extracts, emails, blockchain records), testimonial (interview records) and open source.
- Chain of custody records who handled an item, when, where it was stored and every transfer. A break undermines both admissibility and credibility.
- Preserve originals, work on copies. Capture metadata, hash digital files at the point of collection, and record the hash in the case file.
- Contemporaneous notes should carry date, time, source and author. Notes reconstructed weeks later invite challenge.
- Case file structure: index, executive summary, timeline, evidence log, analysis, correspondence, decisions and approvals, filed report copy, retention record.
- Retention: FATF expects CDD and transaction records to be kept for at least five years; many jurisdictions require longer, and a litigation hold overrides routine deletion.
- Confidentiality markings and need-to-know access. Flag legal privilege questions rather than assuming privilege exists.
- Collect what contradicts your hypothesis as well as what supports it.
Worked example
An investigator finds a supplier invoice in a customer's webmail account. The wrong approach is forwarding the email to a personal inbox, which alters headers and loses provenance. The right approach: export the message with full headers, record the message identifier and mailbox, hash the export, store it in the case management system with a chain-of-custody entry, and cite the artefact identifier in the analysis rather than "an email I reviewed".
Traps that cost marks
- Editing or annotating original files.
- Screenshots with no URL, timestamp or collector name.
- Storing evidence on local drives, personal devices or personal email.
- Summarising a document in the file without retaining the source.
- Deleting closed case files before the retention period expires.