Exporting And Deliverables

13.1 Export Evidence ZIP

Export an evidence ZIP when a single evidence item must be provided or reviewed independently. Use cases:

• Exhibit preparation.
• Targeted legal disclosure.
• Technical validation of one capture.
• Sharing one item with a subject matter expert.

Before delivery:

1. Compute the evidence ZIP hash.
2. Confirm the package opens.
3. Confirm the report and summary are present.
4. Transfer securely.
5. Record recipient and transfer method.

13.1.1 Download an Individual Evidence Package (Version 6)

In the Case Manager, select an evidence item and use the download button in EVIDENCE DETAILS, or open the evidence-table context menu and choose the evidence download action. This saves the original evidence ZIP rather than only a screenshot or preview.

Version 6 can retrieve evidence packages from active acquisition archives and closed cases, including password-protected case packages when the required access credentials are provided. The original archive and its contents are not modified by retrieval.

1. Select the correct case, acquisition, and evidence ID.
2. Download the individual original evidence ZIP to an approved review or transfer location.
3. Record its resulting filename and SHA2-256 digest; verify expected summary, timestamp and report contents before delivery.

Handling distinction: A preview-image download is not the same deliverable as the complete evidence ZIP. Use the complete package when proof of integrity and provenance is required.

13.2 Export Acquisition ZIP

Export an acquisition ZIP when the full session must be reviewed. Use cases:

• Legal review of complete collection session.
• Technical validation of all evidence in an acquisition.
• Review of browser profile, network capture, or logs.
• Demonstration of investigator workflow.

The acquisition ZIP has more context than individual evidence packages and may contain sensitive session artifacts.

13.3 Export Case ZIP

Export the case ZIP when the entire investigation must be delivered or archived. Use cases:

• Final case closure.
• Handoff to legal team.
• Disclosure production.
• Long-term evidence archive.
• Transfer to another forensic examiner.

The case ZIP is the most complete and sensitive deliverable.

13.4 Password Protection

If password protection is available, use it for exported case packages containing sensitive evidence. Follow these rules:

• Use strong passwords.
• Do not send the password with the ZIP.
• Store passwords in an approved secrets system.
• Record who received the password.
• Follow organizational encryption policy.

Caution: Password protection does not replace secure storage, access control, or transfer procedures.

13.5 Secure Transfer Recommendations

Use secure transfer methods:

• Encrypted evidence portal.
• Approved secure file transfer platform.
• Encrypted external media with chain-of-custody documentation.
• Internal evidence repository.
• Legal discovery platform with access logging.

Avoid:

• Consumer file sharing.
• Unencrypted email attachments.
• Personal cloud accounts.
• Informal messaging channels.

13.6 Delivering To Legal Teams

When delivering to legal teams, include:

• Final ZIP package.
• Export hash.
• Brief package description.
• Case report PDF.
• Verification instructions.
• Known limitations.
• Password delivery instructions, if applicable.

Legal teams may not need every technical artifact immediately, but the package should preserve them.