Walk me through how you handle evidence so that it holds up later.

Document everything and minimize handling. Record who collected what, from where, at what time and with which tool; hash the evidence at acquisition and verify that hash after every transfer; work only on copies; store originals with restricted, logged access; and record every custody change. Keep contemporaneous timestamped notes, and use write blocking or forensically sound acquisition so you can prove you did not alter the source.

I work on the assumption that any case can turn into an employment matter or an insurance claim, because you never know at hour one. At acquisition I record the source system, the time in UTC, the tool and version, and who is doing it, then hash the image straight away and record that hash in the case notes. I work on a copy, never the original, and I verify the hash again after any transfer so I can show it did not change in my hands. The original goes into restricted storage where access is logged, and every time it moves the custody log gets a line: who, when, why. My notes are contemporaneous, written as I go and timestamped, and I do not tidy them up afterward, because a clean rewritten narrative is worth less than messy real time notes. If there is any hint of criminal activity or regulated data, I stop and bring legal in before I touch anything else.