Incident Analysis

What to put in an evidence pack for a lawyer

Estimated Reading Time =

2 minutes

Technical Level =

Expert

Threat Level =

High

Attack Type =

Other

Editorial illustration for what to put in an evidence pack for a lawyer

What you will learn

What you will learn

An evidence pack should let an authorized legal reviewer understand the sources, timeline, handling, and gaps. Ask counsel to direct legal scope and distribution while keeping the technical record clear.

An evidence pack for legal review should help an authorized adviser understand the facts and their sources. It is not improved by adding every available document. A clear timeline, controlled originals, and an explanation of gaps are easier to assess than an unexplained mass of files.

Understand the idea

Ask the legal reviewer to direct the relevant scope and handling requirements. Keep source material distinct from analysis and assumptions. Record collection details, access, important decisions, and the link between a statement and the evidence supporting it. Do not assume that adding a legal label creates special protection.

A simple way to follow the process
  1. Index

    Explain the material, its source, and what question it answers.

  2. Context

    Preserve time ranges, collection methods, and limitations.

  3. Handling

    Control access and follow the agreed preservation route.

A practical example

Imagine an incident lead preparing account activity for counsel. The pack includes the original provider export, a dated timeline, collection notes, and a list of unresolved questions. Each conclusion points to a source instead of relying on the incident lead’s memory.

Visual guide: What to put in an evidence pack for a lawyer
Explain the material, its source, and what question it answers. Preserve time ranges, collection methods, and limitations. Control access and follow the agreed preservation route.

What to do next

  1. Timeline: Original timestamps, time zones, normalized working times, and any clock uncertainty.
  2. Source register: Systems, export methods, queries or scope, collection times, and collectors.
  3. Evidence index: File identifiers, integrity information where appropriate, storage location, and handling record.
  4. Actions and decisions: What was changed, who approved it, why, and when.
  5. Known gaps: Missing logs, unverified assumptions, collection limits, and open questions.
  6. Contacts: Technical owners, suppliers, responders, and the authorized legal contact.

How to check the result

Have an authorized reviewer trace a sample fact to its original record. Confirm distribution, retention, and any legal-handling instructions with the appropriate adviser.

Can we claim a document is legally privileged just by labelling it?

Do not assume a label establishes legal protection. Ask counsel to determine the applicable legal treatment and the appropriate handling and distribution.

Sources and useful guides

The following resources provide background and more detailed guidance. Use the sections that match your service and situation.

Scroll to Top