Skill 25 of 30

Digital and multimedia evidence

Digital Evidence Acquisition Planner

Translate lawful authority and source inventories into a precise, preservation-first examiner handoff.

View SKILL.md on GitHub Download this skill
AI-assisted draft. Not a forensic conclusion.

Use this skill only with authorised material and within the user's role, competence, jurisdiction, laboratory procedures and information-handling rules.

When to use this skill

Prepare authorised, tool-neutral digital preservation and acquisition plans for devices, accounts, cloud sources, and media. Use to control scope and handoff; not for unauthorised access, credential theft, or exploitation.

What to provide

  • documented authority and scope
  • device, account and source inventory
  • current state and known risks
  • time ranges and data categories
  • agency digital-forensic procedure
  • examiner and preservation requirements

If a material input is absent, it should remain marked as unknown. The skill must not reconstruct missing facts from narrative fit.

Method

  1. Map each requested source and data category to the recorded authority.
  2. Identify preservation urgency, volatility, encryption, remote-change and time-source risks at a planning level.
  3. Define identifiers, original-state records, hash and acquisition-log requirements.
  4. Distinguish physical, logical, cloud, provider and user-export requests.
  5. Flag over-collection, ambiguous scope, unsupported access and specialist dependencies.

Direct observations, reported facts, test results, expert interpretations, hypotheses, unknowns, conflicts and exclusions must remain in separate fields.

Outputs

  • scope-control matrix
  • preservation request
  • examiner handoff plan
  • source and time-range inventory
  • authority and risk exceptions

Every material statement should cite an exhibit, file, page, image, timestamp, record, standard or named assumption.

Hard limits

  • No credential theft, bypass, exploitation, persistence, covert access or surveillance expansion.
  • Do not provide steps to defeat security controls.
  • Do not acquire or disclose data outside recorded authority.

The skill must not determine guilt, recommend arrest or coercive action, invent evidence, backfill records, promise admissibility or hide potentially exculpatory, adverse, inconsistent or limiting information.

Required human review

Reviewer: Digital forensic examiner, investigating officer and legal reviewer.

The reviewer must approve, amend or reject each material observation and interpretation before operational, laboratory, prosecutorial or court use.

Sample prompt

Use $digital-evidence-acquisition-planner to compare the proposed acquisition with the authorised scope and flag over-collection risk.

Skill source files

Skill instructionsScope, intake, method, outputs, limits and review requirements OpenAI metadataDisplay name, description and default prompt Discipline guidancePrimary publications and controls specific to this skill Core forensic workflowEvidence states and the shared output contract Safety and human reviewProhibited uses, scientific controls and reviewer levels India legal layerBNSS, BSA, MHA and local implementation controls

View the complete Forensic AI Skills project on GitHub.