Training package: digital evidence, OSINT and disclosure

Standardized educational package · updated on 08/20/2026

The route from initial discovery of digital material to reproducible verification, preservation and procedural disclosure.

Open a selection of sources

1. Purpose and expected result

Create a verification log and chain of custody.
Distinguish authenticity, admissibility and probative weight.
Prepare a controlled disclosure package.

2. Audience and prerequisites

For lawyers, judges, prosecutors, investigators and trainers. The basic prerequisite is an understanding of the Criminal Code and Criminal Code of Ukraine and the principles of international humanitarian law.

3. Approximate study plan

20 min — primary map of concepts.
60–90 min — work with primary sources.
45 min — practical exercise.
15 min — checklist and self-check.

4. Normative core

Start with current Ukrainian legislation and the relevant international treaty. Use policies, manuals and analytical materials according to their normative weight. Bills are not valid law.

5. Key sources

In the thematic selection, each source has a status, jurisdiction, date of last review, estimated time, and a brief practical conclusion.

6. Practical exercise

Take public material and document it without uploading personal data.
Make two alternative hypotheses of origin.
Prepare a list of materials, methods, and limitations to be disclosed to the other party.

Level	What are we fixing?	Control
Origin	URL, author, date, platform, method of receipt	Independent confirmation
integrity	Original, hash, storage chain	Immutability of copies
Contents	What exactly can be seen or heard	Do not go beyond the material
Context	Time, place, people, event	Geo- and chronolocation
Disclosure	Versions, methods, materials for the benefit of protection	Completeness and deadlines

7. Work checklist

Save the original and metadata.
Record the URL, access time and retrieval method.
Compute and verify the hash.
Describe the verification method so that it can be repeated.
Save materials that can support an alternate version.

8. Self-test: 10 questions

1. Has the nature of the armed conflict been determined?

Record the facts, the standard and the time limits, not just a summary label.

2. Is a specific rule of law named?

Referring only to Article 438 without a specific provision of IHL does not explain the nature of the violation.

3. Are material, mental and contextual elements separated?

For each element there must be a separate fact, source and level of proof.

4. Has the status of the person or object been verified?

The status is determined by the facts at the relevant time and may require separate proof.

5. Has the nexus with the armed conflict been proven?

Temporal proximity to a war does not in itself always prove the necessary connection.

6. Is the provenance of each piece of evidence reproduced?

Check the source file, metadata, receive, transfer and conversion log.

7. Have alternative explanations been tested?

A strong position should directly test versions compatible with innocence or other qualifications.

8. Are the materials taken into account in favor of the defense?

Check disclosure for completeness and record requests for missing materials.

9. Has the editorial and procedural status of the source been verified?

Open the official text, date, instance and further history of the decision.

10. Are the limits of the conclusion formulated?

Separate established fact, expert assumption, analytical assessment and legal conclusion.

9. Ethics, safety and typical risks

Adhere to confidentiality, do no harm, data minimization and professional independence. The educational package is not an individual legal consultation.

10. Relevance and further education

Source status verified on August 20, 2026. Before procedural use, double-check the edition. The recommended cycle of editorial review is once a quarter.