Global Digital Forensics
Information gathering library

Start Here: Preparing a Useful Specialist Handoff

How to use the seven preparation packages, the worksheets and the handoff steps

Edition 2026-11-03 | November 3, 2026

Use these packages to find, describe and organize information before you engage an auditor, cybersecurity consultant, forensic examiner, attorney or export control specialist.

Questions about this document: call (800) 868-8189 or write to info@evestigate.com.

How to use this library

Begin with the records you already have.

Each package follows the same pattern. It opens with the facts to settle before you gather, lists the records to find with a suggested owner for each, gives a short question set for client IT and system owners, and closes with the decisions that belong to counsel or the receiving specialist. An unanswered question is a request for help, not evidence of a problem.

Work from the CSV worksheets. Import them as UTF-8, keep the ID columns as text, and widen and wrap the columns before you start. The blank response columns are for your entries. Each worksheet is an index: point to records held in your approved evidence location rather than pasting passwords, patient data or controlled technical information into it.

The first conversation

Open Intake-template.csv and settle seven topics with the business sponsor and counsel: the matter and organization, the purpose and who asked for the work, the period and locations, the people involved, the systems and data, any immediate concerns, and how records will be shared. Immediate concerns come first. An active incident, imminent deletion, expiring logs, a court order or a contractual deadline goes to counsel or the responsible specialist at once, ahead of the worksheet.

Walkthrough from request to handoff

Eight steps take a matter from the first request to a controlled handoff.

1. Name the matter and the recipient

Record the legal entity, business unit or case, the intended recipient, the purpose, the relevant period, the sites, the systems and the client contact. Ask the recipient which criteria, versions and deliverable format they expect. Keep an audit preparation request separate from an incident response or litigation deadline.

2. Identify people and places

Ask the business owner what work occurred and ask IT where the resulting information lives. Include providers, acquired businesses, former accounts, paper files and legacy systems. Start with the data source atlas and create one inventory row per actual tenant, repository or device, not one row per vendor name.

3. Check authority and preserve when necessary

Before anyone changes accounts, retention settings or content, ask counsel and the authorized system owner what must be preserved and who can act. Escalate short lived logs and pending deletions promptly. Check that each hold covers the intended scope and was applied successfully, and record the date it took effect.

4. Gather existing records safely

Request existing exports and documentation through approved channels. Ask for a scoped collection plan if forensic acquisition, production testing, restoration or third party access is needed. Use IDs and redacted examples until the receiving specialist confirms a secure route, and keep passwords, recovery secrets, private keys, patient records and controlled technical data out of ordinary email and web forms.

5. Describe what was supplied

Give every request an ID and every record an identifier. Record the source system, account or tenant, owner, period, collection time with time zone, method, filters, permissions, file format and known omissions. Where appropriate, the collector creates and verifies a cryptographic hash. A matching hash shows two copies are identical, so the specialist reviews exactly the record that was collected.

6. Show gaps and limits

Use the statuses Not started, Requested, Received awaiting specialist review, Partially received, Not available after inquiry, and Proposed not applicable awaiting confirmation. Explain a missing period, an excluded field, a failed export or an uncertainty. Keep Unknown as Unknown, and mark a request complete when every record it asks for has arrived.

7. Prepare a controlled handoff

Reconcile the request checklist with the file inventory. Separate ordinary records from restricted evidence and potentially privileged material. Agree access, permitted recipients, transmission encryption and retention, then obtain a receipt and list the follow up questions. The recipient decides whether the information supports the proposed engagement.

8. Keep the package current

Keep the edition and the date the sources were last checked with the handoff. Recheck the rules and vendor documentation before the next engagement and whenever the facts change. Version new submissions, keep the earlier index and explain the changes. Release a preservation hold or destroy records only on the decision of the owner and counsel.

Who helps with the gathering

Small organizations combine roles; the decisions stay with the person who holds the authority.

RoleWhat they contribute
Business contactExplains the business, the relevant events, services and people, and can point to records without answering technical control questions.
Project coordinatorTracks requests, owners, dates, follow up and the handoff, and keeps receipt separate from specialist acceptance.
IT and provider contactsDescribe actual systems, permissions, retention, logging and export limits, and arrange authorized technical work.
Counsel and privacy leadDecide case scope, preservation, legal authority, privilege, protected information and applicable duties.
Receiving specialistAgrees criteria and scope, specifies further evidence and evaluates it. Export classifications and audit conclusions stay with qualified decision makers.

Suggested handoff folders

Use Record-index-template.csv for one row per file or defined record set: the request it answers, the original source, date range, collector and method, approved location and limits. Handoff-checklist.csv tracks the ten handoff steps.

FolderContents
00 Scope and contactsEngagement purpose, entity or matter facts, period, owner roster and exclusions.
01 Requests and responsesCompleted request list, IT questionnaire, follow up records and open questions.
02 Record indexPointers to approved evidence locations with source, date, method, limits and receipt; no sensitive data in the index itself.
03 Source recordsExisting policies, diagrams, contracts and exports; restricted material stays in its approved repository.
04 Specialist decisionsApplicability, legal or process decisions, export classifications or the technical collection plan once supplied.
05 Handoff and updatesTransmittal, recipient receipt, known gaps, version history and supplemental requests.

Choosing the right package

Seven packages cover the most common requests. For other programs, the table shows what to collect first.

ProgramStarting factsRecords to locateWhere to start
NYDFS Part 500Entity operating, or required to operate, under a DFS authorization.Legal entity and license, examination request, exemption and Class A support, period and program records.Package 01.
New York private informationNew York resident data, owner or maintainer status and sector.Data fields and combinations, data flows, safeguards, entity facts and any incident chronology.Package 02.
CMMC and defense safeguardingActual solicitation, contract, flowdowns, data types and current modifications.Signed clauses, SSP and boundary, FCI and CUI facts, providers and assessment records.Package 03.
EAR and ITARItems, software, technology and services, parties, locations and planned activity.Specifications, prior classifications, licenses and agreements, access map and data handling.Package 04.
Departed employee, commercial or medical mattersThe legal matter, its issues, custodians and period.The sources listed in the package for that matter type.Packages 05, 06 and 07.
Other federal contracting or cloud reviewAgency, contract, data and cloud service context.Agency clauses, security attachment, required framework and revision, boundary and authorization.Collect these records, then ask the specialist which framework applies.
HIPAA security reviewCovered entity or business associate facts.Role and agreements, ePHI flows, risk analysis and program records.Package 07 covers a legal matter; scope a HIPAA security review with the specialist.
FTC Safeguards RuleBusiness activities and which regulator has jurisdiction.Business model, customer information, provider arrangements, existing program and regulator correspondence.Collect these records with the current 16 CFR Part 314 text.
Utilities and operational technologyFacilities, sector, state and permits.Applicability register, operating permissions and facility evidence.Use the OT assessment planning library at evestigate.com/resources/ot-assessment-planning-library/.

Common terms

TermMeaning
CustodianA person who may hold or manage relevant information. The system owner may be someone else.
TenantAn organization specific cloud environment. One company can have several tenants and acquired or dormant domains.
Native fileA file in its original working format. A PDF printout can omit formulas, comments, versions, metadata or embedded material.
MetadataInformation describing a record, such as dates, owner, IDs or revision details. Its meaning depends on the application and the collection method.
LogA record of selected system activity. A log covers an event when logging was enabled, captured that event and kept it for the period in question.
ArchiveA retained repository that may preserve selected content. Coverage depends on capture, indexing, policy and configuration.
BackupA recovery copy. Confirm its contents, restore capability and point in time; searching it and holding it are separate steps.
Legal holdA preservation measure directed by counsel or an authorized process. The instruction, the technical implementation and the confirmation are separate records.
CUI and FCIControlled Unclassified Information and Federal Contract Information. The contracting or data owner confirms the category and its contractual basis.
ECCN and USMLAn Export Control Classification Number under the EAR and the United States Munitions List under the ITAR. A specialist determines classification and jurisdiction from the facts.

Receiving the package and timing

Receiving the package

Ask the recipient to acknowledge what arrived, name any unreadable or missing files and confirm the next request. Keep their substantive review separate from the delivery receipt. A complete collection is the starting point the specialist works from for the audit, export review or test planning.

Timing and urgent matters

Agree gathering dates with the recipient based on records, access and provider availability. Those dates are project targets. Active incidents, imminent deletion, filing deadlines, litigation orders and pending transactions go to counsel or the responsible specialist immediately, outside the ordinary package schedule.

Talk to a senior examiner

Get a free consultation. The initial consultation is free, and requests are handled in confidence.

Call (800) 868-8189 at any hour, or write to info@evestigate.com.

Request a consultation online at evestigate.com/contact.