# Incident evidence handoff

Version 1.0 | 2026-10-22 | CC0-1.0

## Question and scope
- Incident/case reference:
- Authorized systems, accounts, and dates:
- Decisions needed by the receiving team:

## Evidence delivered
- Evidence identifiers and source descriptions:
- Acquisition methods, timing, and operator references:
- Manifest and hashes:
- Handling/transfer log:

## Coverage and changes
- Unavailable or expiring data:
- Errors and skipped material:
- Live response actions and known changes:
- Clock and time-zone assumptions:

## Analysis status
- Direct observations and source locations:
- Interpretations requiring corroboration:
- Contrary observations:
- Open questions and next discriminating test:

## Receipt
- Receiving reference and time with offset:
- Transfer verification result:
- Access restrictions and required follow-up: