Create an investigation plan
Define allegations, authority, stakeholders, confidentiality, scope, preservation and reporting lines.
Map evidence sources
Identify endpoints, mobile devices, collaboration platforms, email, cloud storage, logs and third-party records.
Preserve chain of custody
Use exhibit identifiers, acquisition records, hashes and controlled evidence storage.
Review proportionately
Prioritise the issues and date ranges relevant to decision-making.
Prepare decision-ready findings
Present a clear chronology, evidential support, limitations and recommended next steps.
Important: This is general guidance. Legal authority, privacy, employment law, privilege and evidential requirements should be considered for the specific matter.