What Prosecutors Actually Need in a Court-Ready Evidence Export

Most digital evidence exports get sent back by the prosecutor at least once. The file list is incomplete, the hash chain is missing, the audit log is a CSV without a signature, or three files are corrupted because someone re-encoded them in transit. By the time the package is right, the trial date is closer than it should be and the relationship with the prosecutor's office is more strained than it should be. This article describes what a court-ready evidence export actually looks like, and how to produce one without rebuilding it from scratch every time.

Intelintake's export pipeline was built against the requirements below. Every artifact this article describes — the case summary, the signed audit log, the per-asset hashes, the tamper-evident bundle — corresponds to something Intelintake produces from a single export action. If your current system requires manual assembly, the rest of this piece is the spec to either build against or shop for.

Why the discovery handoff is harder in 2026

Two things changed in the last three years. Defense attorneys got faster at challenging digital evidence on chain-of-custody grounds, and prosecutors got stricter about what they will accept from agencies. The combined effect is that the bar for a court-ready evidence export has moved up. A folder of files with a cover sheet does not clear it anymore.

When a prosecutor receives a package today, they are looking for four things at once: every relevant asset, proof that each asset is unchanged from collection, a clear timeline of who touched what, and a verifiable signature over the entire bundle. Anything missing is a request for revision; anything alterable is a vulnerability the defense will exhaust.

What belongs in a court-ready export

A defensible export package contains the following. Intelintake produces all of these from a single export action; if you are building manually, treat this list as your acceptance criteria.

1. Every asset associated with the case, in original format

Originals — not transcoded copies. Video should be the file the witness uploaded, with original codec and container. Photos should retain EXIF. If your intake system re-encoded the file at receipt, you have already lost evidence. Intelintake stores originals untouched and renders previews from separate derivatives, so the export contains the file as collected.

2. A case summary PDF

A single document that describes the case at the time of export: case header, every asset listed by filename and SHA-256 fingerprint, and a narrative entry per asset showing how it entered the case, when, and from whom. The prosecutor and the defense should be able to read this end to end and understand what is in the bundle without opening a single file. Intelintake generates the case summary PDF as part of every court-ready export.

3. A signed audit log with hashes

Every view, download, comment, tag, and export against the case, in chronological order, with full attribution — user, timestamp, IP, and user-agent — and with the SHA-256 hash recorded at each handling event. This is the document a prosecutor cites when arguing that custody was unbroken, and the document a defense attorney reads to find a gap. Intelintake exports the audit log as a signed PDF; if any line is altered after export, the signature breaks and a third party can detect it.

4. A tamper-evident bundle signature

The export as a whole is signed, not just the documents inside it. If anyone modifies any file in the bundle — the originals, the case summary, the audit log — the signature breaks. Intelintake signs every court-ready export at the bundle level and includes a verifiable public key, so the prosecutor can confirm the bundle has not been altered without contacting your agency.

The five failures we see most often

Patterns from agencies running their first prosecutor reviews on an Intelintake export, versus what they were producing previously.

1. 01Re-encoded videos. The intake system transcoded the original to a smaller file for storage. The hash no longer matches what the resident captured. Fix: never re-encode originals at intake. Render derivatives from a separate path.
2. 02Mixed file inventory. Some assets are in the export, some are sitting in a detective's inbox from when they were forwarded for a second opinion. Fix: a single intake surface so every asset is in one place by construction.
3. 03Audit log gaps. The system logged uploads and downloads but not views, tags, or comments. Defense asks about a tag added two weeks ago; agency cannot say who added it. Fix: log every interaction, not just file movement.
4. 04Unsigned exports. The bundle is a ZIP with no signature. Three months later the agency cannot prove the export the prosecutor has is the same one the agency produced. Fix: cryptographic bundle signature with a verifiable public key.
5. 05Stale case ownership. Two officers on the original case have transferred. The prosecutor's office cannot reach anyone who knows the case. Fix: track the current case owner in the intake system itself and update it at every personnel transition, so the case summary always names a reachable contact.

The workflow that produces a clean export every time

This is the sequence that an Intelintake-driven case follows, end to end, regardless of how the evidence was collected.

1. 01Open the case in Intelintake at the start of the investigation. Every submission link, every tip, every canvass upload routes into this case from the first byte.
2. 02When the case is ready for discovery, click "Generate court-ready export" on the case header.
3. 03Choose the scope: full case, a specific date range, or a tag-filtered subset. The prosecutor's request controls this.
4. 04Intelintake builds the package: originals, case summary PDF, signed audit log, and the bundle signature.
5. 05Send the bundle to the prosecutor's office via their preferred secure channel.
6. 06When the prosecutor verifies, they re-hash the originals and check against the audit log, and confirm the bundle signature against the included public key. The verification can happen without ever contacting your agency, which is the point.

What to look for in your current system

If the system in front of you cannot produce most of the list above without manual assembly, the discovery surface is exposed. Use this checklist with your current vendor or with a new one.

• Can the system export originals without transcoding?
• Does every asset in the export carry a SHA-256 fingerprint computed at receipt?
• Is there a single case summary document that describes the case and lists every asset?
• Is the audit log exported as a signed document — not a plain CSV — with full attribution on every event?
• Is the bundle cryptographically signed with a verifiable public key?
• Can the export be re-generated on demand without affecting the live case?

Intelintake meets every item by default. If your current system meets fewer than four, the next discovery challenge is going to cost more time than the migration would. If you want to see the export pipeline run on a sample case, the demo link on this site routes directly to our team and we will walk through it on live data.