Skill 28 of 30

Digital and multimedia evidence

Electronic Evidence Pack Builder

Produce a traceable electronic-evidence index that lets legal and technical reviewers test authenticity and statutory requirements.

View SKILL.md on GitHub Download this skill
AI-assisted draft. Not a forensic conclusion.

Use this skill only with authorised material and within the user's role, competence, jurisdiction, laboratory procedures and information-handling rules.

When to use this skill

Organise electronic-evidence provenance, acquisition, hashes, transformations, certificates, custodian details, and witness records for legal review. Use for pack completeness; not to certify admissibility or create false certificates.

What to provide

  • electronic files or forensic images
  • source and custodian details
  • authority and acquisition logs
  • hash and transformation records
  • tool outputs
  • current jurisdictional legal and certificate requirements

If a material input is absent, it should remain marked as unknown. The skill must not reconstruct missing facts from narrative fit.

Method

  1. Identify the original source, acquisition route and every derivative.
  2. Distinguish system-generated metadata, user-created content and examiner-created notes; record the source and extraction method for each.
  3. Reconcile hashes, tool versions, timestamps, time zones, clock offsets and transformation history.
  4. Map each item to the custodian, examiner and witness needed to explain it.
  5. Retrieve current statutory and local requirements rather than using memory.
  6. List missing provenance, certificate, tool, authority and continuity material.

Direct observations, reported facts, test results, expert interpretations, hypotheses, unknowns, conflicts and exclusions must remain in separate fields.

Outputs

  • electronic-evidence pack index
  • provenance and integrity matrix
  • certificate and witness checklist
  • transformation manifest
  • legal-review issues

Every material statement should cite an exhibit, file, page, image, timestamp, record, standard or named assumption.

Hard limits

  • Do not certify admissibility or generate, sign or backdate a certificate.
  • Do not assume a hash proves authorship or truth.
  • Do not expand acquisition or disclosure beyond authority.

The skill must not determine guilt, recommend arrest or coercive action, invent evidence, backfill records, promise admissibility or hide potentially exculpatory, adverse, inconsistent or limiting information.

Required human review

Reviewer: Digital forensic examiner and qualified legal reviewer.

The reviewer must approve, amend or reject each material observation and interpretation before operational, laboratory, prosecutorial or court use.

Sample prompt

Use $electronic-evidence-pack-builder to identify missing provenance, integrity, certificate, and witness material under the current jurisdiction.

Skill source files

Skill instructionsScope, intake, method, outputs, limits and review requirements OpenAI metadataDisplay name, description and default prompt Discipline guidancePrimary publications and controls specific to this skill Core forensic workflowEvidence states and the shared output contract Safety and human reviewProhibited uses, scientific controls and reviewer levels India legal layerBNSS, BSA, MHA and local implementation controls

View the complete Forensic AI Skills project on GitHub.