Define the question
State what needs to be clarified and who will use the result.
Evidence preparation
Preserve first; interpret later.
A well-organised intake reduces avoidable loss of context and prevents working copies from being confused with originals.
Initial checklist
Before sending material
Do not alter original files merely to make them easier to view or email.
Preserve originals
Keep native exports, original messages, source documents and available context.
Create working copies
Perform conversion, annotation or redaction only on identified copies.
Record source and time
Note the system, person, date, time zone and method of collection or export.
Build a chronology
Separate confirmed events, reported events, later changes and unresolved gaps.
Minimise transfer
Send only relevant material through the channel indicated after initial contact.
Sensitive material
Do not send evidence in an unsolicited email
Begin with a short description. GIFO will indicate whether a secure transfer channel and additional instructions are required.
A hash supports integrity comparison between copies. It does not establish authenticity, authorship, legality or the truth of the content.