Legal team evidence handoff checklist

Why handoff format matters

The most thorough evidence collection is wasted if the handoff package forces counsel to reconstruct the timeline from a folder of uncaptioned files. Counsel works from narrative structure: who, what, when, where, how, and with what degree of certainty. A handoff that answers those questions in order saves hours of preliminary sorting and surfaces gaps before they become problems in a filing. The checklist below follows the order a reviewer actually reads: identify the matter, present the evidence in sequence, state what is uncertain, attach the custody record, and separate legal characterization from factual observation.

Matter identification

Every evidence handoff should open with a concise matter capsule: who the affected party is, what category of harm is alleged, the time window of the alleged conduct, and any urgent deadlines (restraining order filings, platform takedown windows, statute considerations). This is not a legal argument; it is context that lets counsel triage without first reading the whole file.

• Affected party name or identifier (consistent with communication channel)
• Category of alleged harm: impersonation, synthetic media, cyberstalking, doxing, threats, defamation, NCII, reputational attack, brand abuse
• Time window: earliest and latest known incident dates
• Urgency markers: filing deadlines, platform removal windows, imminent risk indicators
• Current legal posture: has counsel been retained, is this pre-engagement triage, external review referral
• Jurisdiction notes if known (relevant for cross-border material)

Evidence inventory and sequence

The evidence itself should be presented as an indexed, dated chronology rather than a folder of files. Each entry carries its source anchor, capture timestamp, and relationship to other entries. The inventory section is the working spine of the file: a reviewer can scan it in minutes and decide which entries need closer examination.

• Chronology with each entry numbered and dated
• Source URL or location for each entry with capture method noted
• File identifier or exhibit reference that maps back to the original capture
• Relationship to other entries: "same account", "continuation of entry #4", "related to exhibit B"
• Gaps in the chronology explicitly marked with duration and any known reason for the gap
• Excluded material listed with reason (duplicate, irrelevant after review, below threshold)

Uncertainty labeling

A strong handoff separates three classes of statement clearly: what was observed at capture, what was reported by the affected party or a witness, and what is inferred from patterns or incomplete data. Label each entry with its class and do not silently upgrade reported facts to observed ones. A file that states its own uncertainty honestly earns more trust from a reviewer than one that overclaims and gets caught on cross-examination.

• Observed: visible in the captured material itself at the time of capture
• Reported: stated by the affected party, a witness, or a third party — pending verification by counsel
• Inferred: a pattern drawn from multiple observations, explicitly marked as inference with supporting observations noted
• Unresolved: questions the evidence raises that counsel should investigate (e.g., "account A shares timing patterns with account B; common actor is possible but unconfirmed")

Custody and handling record

Attach the custody log as a separate appendix rather than embedding it in the narrative. Counsel should be able to verify the handling trail independently without wading through the chronology. The custody record does not need to be long — it needs to answer the questions a skeptical reviewer will ask: who captured this, when, where has it been stored, who has accessed it, and what versions have been exported to whom.

• Capture event log: who captured each item, when, using which method
• Storage and movement record: where files reside and any transfers between systems
• Access log: who viewed or retrieved each item, by role, with timestamps
• Review log: who reviewed what, when, with what notes, and whether annotations were added
• Export log: what was exported, in which version, to whom, and under what authorization

Separate legal characterization from facts

The handoff should present facts and legal suggestions in separate layers. The factual record is frozen: what was captured, when, and what the surrounding context shows. The legal layer — whether the material constitutes defamation, harassment, a terms violation, or a crime — belongs in a separate section or attachment, clearly marked as suggestion for review rather than conclusion. Counsel should be able to work from the factual record alone and reach their own characterization without unpicking embedded legal claims.

• Factual record: frozen, uninterpreted — source anchors, timestamps, capture metadata, custody events
• Legal suggestion layer: separated from the factual record, attributed to the preparer, marked as preliminary
• Cross-references to relevant platform terms, reporting obligations, and known legal standards for the jurisdiction
• Disclaimer that legal characterization is the responsibility of qualified counsel reviewing the full factual record

Delivery and confidentiality

The handoff delivery method should match the sensitivity of the material. Standard cases may use encrypted file transfer; sensitive matters involving intimate imagery or executive-protection material may require controlled-access evidence desks or counsel-only portals. Record the delivery method, recipient verification, and any confidentiality or privilege designations in the export log.

• Delivery method: encrypted transfer, controlled-access system, counsel portal, physical media
• Recipient verification: how the recipients identity was confirmed before transfer
• Confidentiality designation: attorney-client privilege, work product, confidential business information, or other applicable designation
• Export log updated with version, recipient, method, and date of transfer
• Retention instruction or destruction commitment recorded if applicable

Frequently asked questions

Can we hand off material before counsel is retained? Yes, a proper evidence file can be prepared pre-engagement and transferred once representation is confirmed. The file remains the preparers factual record; legal characterization waits for counsel. What if the evidence contains intimate imagery? Handle under authorization through counsel, with access controls that prevent the affected person from needing to re-encounter the material. Log every access event. Is a platform report sufficient evidence? A platform report is a signal, not evidence. It documents the platform’s response but does not replace the original capture. Include both: the original capture as the factual record, the platform report as context.

• Evidence files can be prepared pre-engagement and transferred once counsel is confirmed
• Intimate imagery requires authorization through counsel with strict access controls
• Platform reports are signals, not evidence — preserve the original capture alongside them
• Legal characterization waits for counsel; the factual record does not need a legal conclusion to be useful