What Makes an Investigation


In Short: A look at the most important elements of an investigation: what makes good evidence, how to develop a strong documentation process, the value of verification, and the key to a safe start.

Building solid evidence

Throughout this kit, we will use the generic meaning of evidence: information that is material to the question, problem, person or process you are investigating. There are legal definitions of evidence that can be much stricter, but this generic meaning serves more diverse investigations.

Evidence provides you with the confirmation of a claim or assumption. It is proof of something that happened, or of something that didn’t happen. Interpreting and attributing meaning to information you collect produces a body of evidence. It’s important to keep in mind that not every piece of information is, or can turn into, evidence.

An investigation is a process of organised evidence collection, which seeks to be as close to the truth as possible. The past leaves behind residue: dust, footprints, documents, videos, audio recordings, witnesses, scents, paperwork, the presence or absence of something that was or wasn’t there before. Collecting evidence means finding and verifying these traces. While it’s impossible to recreate history, these traces of events, relationships, transactions or places can work to prove that your story is based in reality.

If you think about your investigation as a jigsaw puzzle, each link or connection brings you one step closer to seeing the larger picture. As you connect more pieces, the picture starts to become clearer. No matter how much information you collect, you always have something you didn’t have at the start: a clearer framework to search within, a sketch of an image or map, a new source of information or even the starting point for a new investigation. Identifying links between the pieces of information will bring you closer to the answers you seek, and the evidence to prove them.

When you collect enough good evidence, the information you have will be well supported and closer to the truth. Otherwise, any conclusions you try to reach will be incomplete at best and completely wrong at worst. You want a solid, unshakable foundation.

Your checklist for good evidence

Not all evidence is good or relevant. There are some qualities that distinguish what is “good” and useful for your investigation. The best way to make sure you are on the right path is to test the strength, accuracy and integrity of your information, and to ask yourself a few guiding questions.

  • Good evidence is first-hand. Did you witness something yourself; do you have access to the persons involved, or to official documents about it?
  • Good evidence can be documented and preserved. Are you able to map the path that led you to the evidence, record every step of your research process, and save it in a way that other investigators can later access it, confirm its accuracy and make sense of it?
  • Good evidence is timely, created or documented close to when the event occurred. Did a lot of time pass and make the evidence less traceable? Did recordings or documents get lost? You will need to dig up the past or find new information elsewhere.
  • Good evidence can be verified. Can you and others check and confirm that what you have is real and accurate?
  • Good evidence has origins that can be confirmed by a third party, in addition to you and your source. Are you the only one who has access to the source of information, and the only one who can say it is real? If so, this can become a weakness if someone should challenge your evidence or claim you are making it up. However, if you are dealing with a vulnerable source, keeping it a secret may be your - and their - only viable option.
  • Good evidence contains information that can be confirmed by a third party. Is there anyone or anything else that can support your claims and evidence? An expert, another witness, an organisation doing research on the issue, an official document. The more, the better.
  • Good evidence can be shared with other people. Are you able to show this evidence to support your arguments and claims, or is it confidential and therefore needs to stay undisclosed? If that’s the case, you might need additional ways to prove to others that what you are saying is true.
  • Good evidence has a documented, unbroken chain of custody. Did you log every step of your research process? Did you save all findings with exact source details, dates, times and places where you found the information? Did you save all the information safely and make sure it never left your hands, was not tampered with and you can always trace everything back to its original source?
  • Good evidence is uncorrupted and kept safe from tampering. Can you make sure that nobody unwanted has access to it and can modify it in any way?
  • Good evidence includes metadata such as information about its author, location, time. Can you confidently say that you know a photo or a video was taken where the source claims it was, when it claims it was, and shows what it claims it shows? If you collected the evidence and recorded the images yourself, can you prove their authenticity by preserving their metadata? Any lost metadata can be a weakness to your evidence later on. Make sure you keep it safe.
  • Good evidence connects to other pieces of evidence and links information together. Can you connect your evidence with other information and findings from more sources to support your argument or create a stronger narrative about the issues you are investigating?
  • Good evidence will direct you to places where your information is weak or incomplete. Does it open up more questions, show you information gaps and new ways to seek additional evidence? That is a good thing, it will help you gain a better overview of the issue and ultimately build a stronger argument.
  • Good evidence doesn’t expose human sources to risk that the investigator can’t manage. Could someone directly or indirectly link your evidence to a vulnerable source whom, if exposed, may be in danger? If yes, can you reduce those risks in any way to protect that source? Is there any way to find other evidence, which supports your narrative but does not expose the potentially vulnerable source? If not, you may need to reconsider using that evidence and put the safety of your sources and of yourself first.
  • Good evidence may challenge your preconceived ideas or even contradict what you think is true. Does it show that your expectations or arguments aren’t valid? Does it make you see a problem from a different perspective, or even totally change your mind about an issue? Did you believe a source but ended up doubting it once you analysed more evidence from other sources? This is a good thing, and by admitting and accepting it, you are becoming a better, more impartial and hence more trustworthy investigator.
  • Good evidence speaks for itself. Can you just show what you have and be confident that people will understand the information and its meaning? Or do you still need to build a larger picture or a narrative to boost it?

Not every piece of evidence you discover will meet all these conditions. That’s to be expected. But some of the evidence you find will meet a lot of them – those pieces are the ones you may want to prioritise.

Without documentation, it didn’t happen

Collecting evidence, following leads, interviewing, modelling, mapping, planning and all the thinking that form your investigation will be more useful to you – and more supportive of your conclusions – if you document your process. This means keeping track of every step you make; every piece of data and evidence you collect with details such as what it is, where, when, why and how it was collected; preserving this data in its initial form and features, and much more.

The primary goal of documentation is to create a verifiable record of your investigation. Let’s call it ‘investigative hygiene’- regular maintenance of certain practices to ensure your investigation is healthy and can stand up to scrutiny and criticism if anyone tries to dismiss your evidence.

Your record is as much for you as it is for others. Keeping track of your steps will make you more effective as an investigator and less likely to struggle with common mistakes when starting out. As you progress, documentation can help you remember prior conclusions, how you got leads or evidence that seemed useless before but now seems important. You might also find things you forgot to follow up on or problems you wanted to ask someone else to help with.

Being able to confidently state why you pursued one source over another makes you a much more valuable and trustworthy resource. Your documentation habits are important if you intend to publish your findings, if you ever speak to law enforcement, if you pursue a case to court or offer your evidence to human rights defenders who represent cases of crime and abuse. Also, should personal or professional problems or changing socio-political conditions interrupt your work, it will be easier for someone else to interpret it and take on the rest of the investigation or use the evidence you managed to uncover. These habits are also useful if you end up collaborating with other partners.

While documentation is important, there are also risk factors. Your investigation logs may benefit potential adversaries – for example, someone determined to stop you from uncovering their wrongdoing – if the information falls into the wrong hands.

It is crucial that you assess any potential risks at the start of and during your investigation. You need to take your safety and that of your sources seriously, as well as keep evidence and documentation safely, using encrypted storage and devices to protect it from unwanted access.

Make sure you always inform yourself about basic digital and physical security safeguards and learn about tools and skills you may need in order to stay safe and keep your data stored securely. We will address such issues through The Kit but you can also start checking available online resources such as Tactical Tech’s Security in a Box or this Security Checklist. When working in particularly complex situations or environments, ask trustworthy people to advise you or look for safety trainings you may be able to attend if you feel that any of the investigations you pursue may pose even the slightest risk.

Tips for thorough documentation

  • Take detailed interview notes

If you are interviewing sources or meeting with other investigators, always take notes. Record the date, start and end times, location and names of participants. Note what was discussed and if the same people may hold a follow up meeting (“Person X and I decided we would speak again over the phone on Thursday at 14:00”). You can take notes by hand or type them on a device or both, as long as you are able to keep them safe. Audio recording is also a good way to keep track of conversations but obtain the others’ permission to record first. Beware of exposing people’s identities, especially when interviewing and recording vulnerable sources. Everyone’s safety should always be your top priority.

Investigators often use hidden recordings to help expose important information, but we choose not to address it in this kit due to controversies regarding legal limitations in some places and most importantly, the safety risks associated with it.

  • Keep track of contact information

If you are creating a list of contacts, include not only their names and contact information, but also how you came to know them, each time you have spoken and a summary of the information they have offered you. If you have a list of businesses, phone numbers, or email addresses to research, for example, make sure you note where you first encountered the business name, phone number or email. If you have sensitive information and vulnerable, at-risk, sources, give them an alias in all your notes and working documents, online and offline.

  • Record your process

Keep a log of investigative steps you have taken and their outcomes, with dates and details of every tool and technique involved in collecting evidence. For example, you might record: “On 3 January 2018, I and my research partner captured satellite images using Google Earth and documented the location of the company’s construction sites” or “On 14 March 2018, I tried calling different public phone numbers associated with the company to see if I could get records, but I was diverted to voicemail.” As you advance in your research, especially with long term investigations, this will help you remember past steps, you will be able to recall failed attempts to find certain data, or pieces of information you already have and shouldn’t duplicate.

  • Make an outline

As you gather more and more information, it’s helpful to create a rough narrative outline of what you have figured out so far. This will serve as a record of different stages of the investigation, and will help you see what information may be missing, if there are new directions you need to consider, and if certain information should be verified or refined. Also, creating visual maps of your data and investigative process may help you see things in a new light.

  • Protect your evidence

You should create both a physical and a digital log of all the evidence. Include dates, origins, storage location and security information. Your log should also include a description of the status of the evidence, who collected it and who has interacted with it. Keep all of this safe and preferably not all in one place to avoid total loss or damage.

If it’s not verified, it’s not valid


Your town has a decade-old sewage problem, but the mayor claims he has a magic wand that can fix it, if only you would vote for him another time? The neighbouring country is sending troops your way to take over the only clean water resource left in the region? Sure, anything is possible, and there may even be data available to prove it. But if it’s not verified, it’s not valid.

Verification is increasingly important as the quality and trustworthiness of information available today is being challenged from multiple directions – from “fake news” creators and misinformation trolls to ill-informed social media users who spread news without checking sources first.

For example, during the Kenyan election in 2017, fake tweets that looked like BBC or CNN stories were circulated with the intention of misrepresenting the political situation. In India, widely disseminated fake information about alleged criminals has led to people being killed or beaten in the streets.

Whatever the goals of your investigation, it’s important to be able to defend how you got to the information you are presenting as evidence. If something in your investigation is proven not to be true, it undermines your research and any narrative or conclusion you present.

Most of the investigation techniques in this kit can be used to uncover evidence as well as verify it.

There are different levels of evidence during an investigation. Whatever path you follow, you’re always trying to get closer to the first-hand evidence through techniques like verification. Here are some examples of sources of information you may need to address and verify throughout your investigations.

  • Word of mouth. A neighbour heard that members of a minority group in your community are being denied service at a local authority. This sounds more like a rumour for now, so you will need to get closer to the facts.
  • Expert statements. A researcher who has tracked this sort of denial of service to minority groups tells you it’s frequent. An expert statement is a good way to start validating the information you have, but you still need to collect some first-hand information or find more sources stating the same.
  • Second-hand accounts. You speak to people being denied this service. You are getting closer to the actual facts, but any personal experience and statement needs to be checked with other witnesses or existing documentation, if available.
  • Research documents or reports. For example, a report from a credible NGO describes this occurrence based on interviews with directly involved community members. Documents resulted from research bring you a step closer but just as with the expert statements, you still need to corroborate these with witness accounts or at least another source stating the same.
  • Official documents. An official paper documents the denial-of-service incident. Signed and dated official papers are always a very strong piece of evidence as you can identify the institution and people responsible for documenting the case and follow-up with more questions if you need to. Mind institutional bias, when an office may want to hide data rather than expose the truth, especially if it incriminates them. You have a good piece of evidence in your hands now but some witness or expert statements will make it stronger.
  • Photos, video, audio. A recording exists showing the situation occurring. This can be a treasure of evidence for you. If the images and audio are real, they can be linked to the location, time and people involved in the incident. Watch out for image and sound manipulation by checking EXIF data and metadata, verify the source, the contents and do not use it as evidence without reaching out to those involved to confirm its accuracy.
  • First-hand evidence. You are present while the situation occurs and maybe you even manage to film the incident. This is first-hand evidence and the strongest for your investigation. You have the opportunity and, at the same time, the responsibility to document the entire incident thoroughly. You also want to make sure you establish contact with others involved to be able to confirm your observations and evidence, should anyone doubt the accuracy of your investigation later on.

When to verify

The short answer is always.

Verification is an iterative process. You have to keep doing it over and over again. The process is not only related to one piece of evidence you uncover, but also to how all the pieces fit together.

Any new evidence you find may cast reasonable doubt on old evidence that you may have already verified. That is why documenting your evidence is important; so that you can retrace your steps and verify again and again.

Challenges of verification

While at the heart of the investigative process, verification has many obstacles, too. It helps to consider them even before getting started.

Besides how to find other sources of information, your own assumptions can be one of the biggest challenges to overcome.

Whatever you assume about what happened, personal biases will affect how you handle and verify information. Many times, you may just look for sources of information that confirm your biases rather than examine aspects that could contradict your findings.

Your assumptions about the credibility of your human sources can also get in the way of proper verification if these assumptions are not true. It is essential not to take anything for granted since even the most trusted and reliable of sources can sometimes get it wrong, even if unintentionally.

Another challenge is finding creative ways of verification – to be ready to use sources of information in ways they were not intended. For example, if you want to verify whether a public official was somewhere despite him denying so, you may not only want to visit his social media accounts, but also those of his relatives and friends to find clues of messages, comments and images that may confirm or deny that.

How to verify

It helps to first think through any questions or doubts you have about the information you’ve gathered, as well as about your own assumptions and the potential bias you or others involved may have.

What do you know with 100 per cent certainty?

  • If it’s an image, do you know who took it? When was it taken? On what camera? In what place? How do you know it hasn’t been modified? Could anyone try to mislead you by providing this image?
  • Can you truly confirm that subjects and events shown in an image are from the specific day, time, place and incident you are investigating?
  • Is the issue contentious? Are there sides that have something to gain by spreading this information? There are groups spreading false information hoping that someone might give them attention without checking.

There are three main phases of verifying information:

  • Verifying the source. Where you got the information and where it originated.
  • Verifying the content. Whether it is exactly what it claims to be.
  • Verifying its relevance. Whether it fits in to your investigation.

In any investigation, you’ll collect information from many different sources. Some will be obvious, while others may be less clear. You could get an anonymous email, an envelope of documents, see a video on social media or find a document on a random website. If there is any question about the origin of that information, it’s important to verify where it came from - whether it was from the original source, whether it is from someone trustworthy, whether it is accurate or has been fabricated or tampered with, and whether there was some motive behind getting that information to you.

Information and evidence can take various forms and appear on various mediums. Images, videos, sound, written testimonies and webpages are just a few. For each medium there are tools, techniques and tricks that help with the process of verification, and you will find many of them explained in this kit.

You do not need to learn everything about every medium before you start investigating. There will be plenty to discover as you go along, and you will also be able to learn through practice. Complex guides to verification written by experts in the field are also available for you to check if you wish to go in-depth (for example, the Verification Handbook, or the Journalism, Fake News and Disinformation handbook by UNESCO).

In order to rigorously test your evidence and keep your biases in check, you can document your research process and your findings and present them to other investigators to confirm that it makes sense to someone else.

However, always make sure you trust those you are sharing information with at any stage of an investigation and that you – and any collaborators – are aware of ways to stay digitally and physically safe as you communicate and share information. Each topic addressed in this kit also contains useful safety warnings and advice for those of you investigating on your own or collaboratively.

Start where you are


When you are just beginning to investigate, it makes sense to approach the process from the most comfortable and safe point of entry.

If you are the type of internet scout who knows tonnes of social media research tricks or are good at digging into databases and indexing online information about various topics, start with that.

If the virtual space is not your thing, maybe start by observing and documenting what happens in the physical world. Take photos, make detailed notes about events and situations, talk to people and see if you can gain their trust and build sources.

There is no point in starting your first investigation by experimenting with a completely new or uncomfortable way of gathering information. Just start with what you are good at.

With the availability of digital devices and numerous sources of information on the internet, it is possible to conduct various tasks of an investigation from behind a desk. Digital investigations often mainly involve desk research, but they can also include basic offline research, such as going to the library and archives, making phone calls or a combination of all these.

Digital investigation means that you are using digital tools and media to investigate. The subject of your investigation can be digital, such as a YouTube video, or it can be analogue, such as the real estate assets of a politician.

Databases that are accessible on the internet are an opportunity for investigators to uncover information beyond the traditional method of digging into archives of physical records. More and more data can be collected, filtered, connected and verified using digital tools. Yet, conducting investigations from behind a screen is not as safe and straightforward as it may first appear.

There are many digital threats to investigations, particularly if those being investigated are wary of being traced. That’s why, even when conducting digital research, there are important safety measures you need to be aware of in order to reduce the risks. You will read about them throughout this kit.

For some investigations, pen and paper is a more appropriate approach. A combination of traditional and new investigation techniques can be very effective.

Often, despite the abundance of online information, there is evidence that you cannot find with digital resources. It might be the case that there is no data about your topic available in your country. However, you can often find more than you expect just by opting for creative ways of information gathering.

For instance, donor-funded NGOs all over the world are required to conduct background studies to explore the context of their field of interest before starting any project. During this process, they often conduct surveys and collect detailed datasets that never get published.

You might need to find out how many former militia fighters returned to their home villages in your district and that is not an easy task. But an organisation providing psychological support to that specific group may have those numbers available. Similarly, you might want to know how the contamination of a river has affected your local community but it is difficult to collect accurate, scientific proof about this. Perhaps there is an environmental NGO that conducted research and interviews with those who got ill because they drank the contaminated water.

In many cases, such information is not easily accessible to the public especially when it was meant to serve as background data for other purposes. However, if you ask the NGO and explain why you need this data, they might often be ready to give it to you, or to help your investigation move forward.

Some investigations will require you to conduct your own field work to gather evidence and verify it. Field research means that you identify and collect the information first hand and it is your responsibility to document it and confirm its accuracy. It can consist of recording testimonies, gathering samples, observing events and places or going out to various places to talk to people. These approaches will also be addressed throughout the kit.

You also want to be careful when doing field research. Whether you are contacting people to find out if they can be your sources, meeting them to collect more information, or going out to a location to examine evidence, it’s vital to be aware of the various risks involved at every step. Risks to your personal safety and that of others might be high. Sometimes you can reduce those risks, but other times they may be too overwhelming for you to conduct the investigation.

Knowing when to reconsider, ask for help, or set a project aside for a while if possible, is also a healthy attitude and asset to have as an investigator.