Why Evidence Management Defines Investigation Outcomes

An investigation is only as strong as its evidence, and evidence is only as strong as the process used to collect, store, and handle it. In Australian legal proceedings, regulatory examinations, and tribunal hearings, the admissibility and weight of evidence depends on demonstrating an unbroken chain of custody, verifiable integrity, and proper handling throughout the investigation lifecycle.

Most investigation teams manage evidence using shared network drives, email attachments, USB drives, and local folders. This approach creates fundamental vulnerabilities that can undermine otherwise sound investigations:

No chain of custody. There is no verifiable record of who accessed, modified, or moved evidence, or when
No integrity verification. Files can be altered without detection, creating reasonable doubt about authenticity
No access controls. Anyone with folder access can view, copy, or delete evidence, including in matters where they have a conflict of interest
No defensible export. When evidence must be produced for legal proceedings or regulatory examination, there is no systematic way to demonstrate its provenance and integrity

SentinelOps provides investigation-grade evidence management that addresses each of these vulnerabilities.

Chain-of-Custody Controls

Continuous Custody Documentation

From the moment evidence enters the SentinelOps platform, every interaction is recorded in an immutable custody log:

Collection: who collected the evidence, from what source, at what time, and under what authority
Storage: where the evidence is stored within the platform, when it was stored, and any classification applied
Access: every time the evidence is viewed, downloaded, or referenced, with the accessor’s identity and timestamp
Modification: if evidence metadata is updated (tagging, classification, notes), the original is preserved and the change is recorded
Transfer: if evidence is shared with another investigator, legal counsel, or external party, the transfer is documented
Export: when evidence is exported for legal proceedings or regulatory submission, the export event, recipient, and purpose are logged

This continuous custody record means that when a court, tribunal, or regulator questions the integrity of evidence, the answer is documented and verifiable, not dependent on an investigator’s recollection.

Australian Evidence Act Considerations

The Evidence Act 1995 (Cth) and corresponding state legislation establish the framework for evidence admissibility in Australian proceedings. While admissibility ultimately depends on the specific proceeding and jurisdiction, SentinelOps is designed to support the evidentiary foundations that courts expect:

Authenticity (s. 69, s. 146): custody records demonstrate the provenance and handling of each item
Best evidence rule: original digital files are preserved with integrity verification
Business records exception (s. 69): systematic evidence management supports the business records hearsay exception
Computer-produced evidence (s. 146, s. 147): device and process reliability can be demonstrated through platform audit logs

Secure Evidence Storage

Encrypted Storage

All evidence files are encrypted at rest using AES-256 encryption. Encryption keys are managed through a dedicated key management service with automated key rotation. Evidence is encrypted regardless of file type: documents, images, audio recordings, video files, emails, and forensic captures.

Access-Controlled Storage

Evidence access is governed by the same role-based access controls that protect all SentinelOps data. Access can be scoped to:

Case-level: only investigators assigned to a case can access its evidence
Item-level: specific evidence items can be restricted to a subset of case investigators
Classification-level: evidence classified at higher sensitivity levels requires additional authorisation
Time-limited: access can be granted for a defined period, automatically revoking after expiry

Version Control

When evidence-related documents are updated, such as investigation plans, interview transcripts, and analysis reports, SentinelOps maintains version history. Previous versions are preserved and accessible, ensuring that the evolution of investigative thinking is documented. Original evidence files are never overwritten.

Evidence Types Supported

SentinelOps handles the full range of evidence types that investigation teams encounter:

Documents: PDFs, Word documents, spreadsheets, presentations
Communications: emails, chat logs, SMS records
Images: photographs, screenshots, scanned documents
Audio & Video: recorded interviews, CCTV footage, body camera recordings
Financial Records: bank statements, transaction records, invoices
Digital Forensics: forensic images, device extractions, log files
OSINT Captures: social media captures, web page archives, open-source intelligence
Physical Evidence Records: photographs and descriptions of physical items, storage location tracking

Evidence Tagging & Organisation

Structured Tagging

Evidence items are tagged with structured metadata that supports organisation, search, and analysis:

Evidence type: document, image, communication, financial, forensic, OSINT
Source: where the evidence was obtained (witness, system, surveillance, open source)
Relevance: which allegations, issues, or subjects the evidence relates to
Classification: sensitivity level for access control purposes
Status: collected, under review, analysed, produced

Cross-Case Linking

Evidence can be linked across multiple cases when the same item is relevant to different investigations. Rather than duplicating files, cross-case linking maintains a single source of truth while making the evidence accessible to authorised investigators on each related case.

Evidence Integrity Verification

Cryptographic Hashing

SentinelOps generates cryptographic hash values (SHA-256) for all evidence files at the point of upload. These hash values provide tamper-evident integrity verification. Any modification to the file, however minor, produces a different hash value. Investigators, legal counsel, and regulators can verify at any point that the file in the system is identical to the file that was originally collected.

Tamper-Evident Records

Evidence custody records are stored in an immutable audit system that cannot be modified or deleted by any user, including system administrators. This immutability is critical for regulatory environments where the integrity of the investigation record itself may be scrutinised.

Evidence Export & Production

Legal Production

When evidence must be produced for legal proceedings, regulatory examinations, or FOI requests, SentinelOps supports structured export with:

Custody certificate: a documented chain-of-custody record for each exported item
Integrity verification: hash values confirming the exported file matches the original
Access log: complete record of who has accessed the evidence during the investigation
Metadata preservation: file metadata, tags, and classification are preserved in the export

Regulatory Examination Support

For AUSTRAC examinations, AHRC inquiries, or Fair Work Commission hearings, SentinelOps can produce structured evidence bundles that demonstrate both the substance of the investigation and the process by which evidence was handled.

How SentinelOps Helps

SentinelOps transforms evidence management from an ad-hoc, risk-laden process into a structured, defensible capability:

Current State	SentinelOps
Evidence on shared drives with no access logging	Encrypted storage with role-based access controls and full access logging
No chain of custody documentation	Continuous, immutable custody records from collection to production
Files can be modified or deleted without detection	Cryptographic hashing and tamper-evident integrity verification
Email-based evidence sharing with no controls	Controlled transfers with documented purpose and recipient
Manual evidence bundling for legal production	Structured export with custody certificates and integrity verification

Frequently Asked Questions

Does SentinelOps support large file uploads?

Yes. SentinelOps supports evidence files of substantial size, including video recordings, forensic images, and large document sets. Upload limits are configurable based on your deployment requirements.

Can evidence be deleted from SentinelOps?

Evidence deletion follows a controlled process. Deletion requests are logged, require authorised approval, and maintain a record that the item existed and was deleted (including by whom and when). This ensures compliance with document retention obligations while supporting legitimate disposal requirements.

How does SentinelOps handle OSINT evidence?

OSINT evidence, including social media captures, web page archives, and public record searches, can be uploaded with source URL, capture timestamp, and capture methodology documented in the evidence metadata. This supports the authentication requirements that courts apply to open-source digital evidence.

Is evidence stored in Australia?

Yes. All evidence is stored in Australian data centres. SentinelOps does not store or replicate evidence to overseas servers.

Can external parties access evidence?

External investigators, legal counsel, or panel firms can be granted scoped access to specific evidence items or cases. Access is time-limited, logged, and revocable. External users cannot access evidence beyond their scoped permissions.

Evidence Management with Chain-of-Custody Integrity