Evidence packaging for cyber claims

Overview

Insurance adjusters want chronological structured evidence—not chaotic ZIP dumps.

Structure

00_Index.xlsx listing files; folders 01_Timeline 02_Tech_Log_Exports 03_CommCorresp 04_Financial_Impact.

Integrity

Include a SHA-256 manifest (or equivalent) for large exports so recipients can verify files were not altered in transit.

Privilege

Segregate attorney work product in a clearly labeled, access-controlled folder so it is not mingled with general technical evidence.

Chain

Maintain a simple custody log: who acquired copies, from which system, and where forensic images reside; align naming with your forensics vendor.

Timing

When the policy requires a fast submission window (for example within 72 hours), pre-assign a packager, deputy, and legal contact before an incident so handoff is orderly.

Tone

Keep communications factual and cooperative; unclear or defensive packaging slows review and raises questions about preparedness.