The evidence problem
When a disclosure is too large or disordered to review reliably by reading page-by-page.
Typical material
SAR responses, disclosure bundles, attachments, emails, internal notes and exported records.
Reviewable output
Evidence register, chronology, entity map, referenced missing material and review points.
Document register
Create an organised view of the supplied disclosure.
Chronology
Extract events and communications across the disclosure period.
Evidence gaps
Identify referenced attachments, records or periods that appear absent from the supplied material.
METHOD
How this analysis is carried out.
1. Build the disclosure register
Record file identity, source, date, type and obvious relationships before deeper analysis.
2. Extract chronology and entities
People, organisations, communications, events and decisions are organised across the disclosure period.
3. Reconcile references
Referenced attachments, reports, meetings and records are checked against what was actually supplied.
4. Compare later summaries with source
Later reports or decisions are tested against contemporaneous records where available.
5. Produce review points
Missing material, conflicting accounts and evidential discontinuities are presented with source references and limitations.
DELIVERABLES
What a professional output should contain.
Evidence register
A structured record of the material actually reviewed, suitable for audit and later cross-reference.
Source-linked findings
Material observations presented with enough source information to locate the supporting record.
Chronology / analytical schedule
Where relevant, events, transactions, comparisons or issues arranged into a practical working schedule.
Evidence gaps and limitations
A separate record of missing material, ambiguity, assumptions and points that cannot safely be concluded from the supplied evidence.
Review status
Clear distinction between automated extraction, analytical review points and human-reviewed findings.
MOLE REPORT STANDARD
Precise enough to be checked.
Professional evidence work should not hide the route from observation back to source. MOLE outputs are designed around traceability, scope control and explicit limitations.
Question first
The report states what was asked, what material was supplied and what falls outside the review.
Source-linked
Material observations are linked to identifiable source records rather than presented as unsupported assertions.
Fact, inference, limitation
Extracted facts, analytical observations, unresolved points and limitations are kept distinguishable.
Review before reliance
Automated signals remain review points until checked against the underlying material.
Dated and controlled
Reports can be versioned so later evidence or corrections do not silently overwrite the earlier analytical record.
No inflated claims
Where the evidence cannot safely establish a proposition, the report should say so explicitly.
CLIENT EVIDENCE ROOM
Keep the brief, evidence, reports and billing together.
Open a secure MOLE case and track exactly what has been requested and delivered.
Scope: MOLE provides evidence analysis and investigative support. Automated intelligence points require human review. MOLE does not currently claim accredited device acquisition, deleted-data recovery or laboratory computer/mobile examination.