Evidence is logged, sealed and stored securely.
Stage 02 of 04
Evidence intake
Good investigations are built on good evidence. In this stage we gather, verify and preserve everything relevant — so it can be relied on later.
Overview
What happens at this stage.
Once you decide to proceed, we collect the material the investigation needs: transaction records, screenshots, messages, emails, website details and, where relevant, devices or account data.
Each item is logged, verified and stored securely. Where it matters — for example, with phones or computers — we use forensic methods and a documented chain of custody, so nobody can later question whether the evidence was altered.
We also organise everything into a single evidence file with a clear timeline. Many clients tell us that simply seeing their case laid out in order is the first time it has made sense.
At the end of this stage
Secured evidence file
Timing
Usually completed within the first part of the engagement; depends on how quickly records are available.
Scattered records become one organised file.
Devices are handled with a full chain of custody.
What we do
- ✓Collect and catalogue every relevant record
- ✓Verify transactions and details against independent sources
- ✓Preserve devices and accounts forensically where needed
- ✓Build a single, dated timeline of events
- ✓Store everything securely with restricted access
What we need from you
- ✓Send the records we request, in their original form where possible
- ✓Avoid deleting messages, apps or accounts
- ✓Never share passwords, private keys or seed phrases
What you receive
- ✓A secured, organised evidence file
- ✓A clear timeline of what happened
- ✓Confirmation of what is and isn't available
Common questions.
Why does preservation matter so much?+
Evidence that can't be shown to be unaltered can be challenged later. Proper preservation protects the value of your case.
Do you need my phone?+
Only if it holds evidence we can't obtain another way. We'll explain exactly why before asking.
What if I already deleted something?+
Tell us. It may still be recoverable from backups, the other party, or the platform itself.
Confidential case review
Confidential case review
Tell us what happened.
Your message is read by an investigator, not a sales team. We'll reply with an honest assessment of what can be done.
Have a question first? Read our FAQ →
Prefer email? info@gfirglobal.com