Incident evidence checklist
23 things worth checking before somebody disputes what your footage shows.
Written for South African operators flying drones for security work. Most of it is not about software — sections 3 and 5 are about how you work, and no product fixes those for you. Work through it honestly; anything you cannot answer is a place your evidence would be argued with.
1. Can you prove the file has not changed?
The first question an opposing attorney asks about footage is not what it shows. It is whether it is the same file that came off the aircraft.
A cryptographic hash (SHA-256) is recorded for every file
A file size and a timestamp prove nothing — both survive an edit. A digest does not.
The hash was computed on ingest, not on export
A digest computed when you produce the evidence only proves it has not changed since you decided to use it.
Anyone can re-verify the hash against the stored file, on demand
A digest nobody can check is a claim, not a control.
The original file is never overwritten — a new capture is a new object
If the same path can be written twice, the digest belongs to whichever version was written last.
2. Can you show who touched it, and when?
Chain of custody is the record of every hand the evidence passed through. In practice it is a log, and the only question that matters about that log is whether it can be edited.
Every view, download and export is logged with a person and a time
"Somebody opened this" is not a chain of custody.
The log is append-only — nobody can edit or delete an entry
Including your administrator, and including your software supplier. A log that can be tidied is a log that will be.
The log is written before access is granted, not after
If the file is served first and the log written second, a failure between them hands out access nobody can see.
Access requires a short-lived link, not a shared folder
A link that works forever is access you can no longer account for.
3. Were you allowed to hold it? (POPIA §§9–14)
Footage of an identifiable person is personal information. Holding it lawfully needs a purpose, a limit, and a plan for getting rid of it.
You can state the purpose for each kind of footage you keep
POPIA §13. "In case we need it" is not a purpose.
A retention window is set per site, and it is enforced automatically
POPIA §14. A policy nobody executes is the same as no policy, and is worse in an audit.
When footage expires, the record of it survives
Destroying the row as well means an export from last year references evidence you now deny existed.
You can answer "what do you hold about me?" within a reasonable time
POPIA §23. The request will come from a contractor or an ex-employee, not a stranger.
You can erase a person without destroying an incident record
POPIA §24 asks you to stop holding the information, not to destroy somebody else’s evidence.
An Information Officer is registered with the Regulator
POPIA §55. Required of every private body, and frequently forgotten.
4. Does the record stand on its own?
The document leaves your hands and is read by somebody with no access to your system and no reason to trust you.
The report states the time zone explicitly (SAST, +02:00)
A timestamp with no zone is an argument waiting to happen.
It carries the digest of every attached file
So integrity can be checked on paper, by somebody who cannot log in.
It includes the access history, not just the incident
The custody chain is the part that answers "how do we know this is what happened?"
Severity reads in plain words a magistrate would use
"Critical" is a finding. A game-styled label in a legal document invites the reading that the whole system is a toy.
It says plainly what the system does NOT do
A report that quietly implies facial recognition invites a question you do not want.
5. Can somebody else produce it, at 03:00, without you?
The test of an evidence process is whether it works when the person who designed it is asleep.
The controller on shift can produce a complete report unaided
If it needs you, it is not a process.
It takes minutes, not a morning
A process that costs a morning gets skipped on the night it matters.
Nothing is retyped from one system into another
Every retyping is a place the record and the reality can differ.
The ground team’s acknowledgement is captured automatically
Response time is the number your client asks about. If nobody logs it, you are guessing.
Where this came from
RAPTOR does every item in sections 1, 2 and 4 automatically, and makes section 3 a setting rather than a policy document. We run free pilots — one aircraft, one site, fourteen days, no card.
Not legal advice. POPIA section references are given so you can look them up; confirm your own position with an attorney or your Information Officer.