Photographs can show a condition, position or change that words alone struggle to describe. Their value depends on the question asked, the capture context and the ability to distinguish an original file from later presentation copies. This guide is a practical record-keeping method for an authorised site visit, not a rule of evidence or a promise that an image will be admitted in any proceeding. The Australian Cyber Security Centre recommends recording who handled digital evidence, when (including the time zone) and what was collected; NIST explains why source, transfer and storage records matter for digital images. ACSC evidence guidance; NIST IR 8387.
1. Define the proposition before taking photographs
Write the factual question in one sentence: “Was the eastern access route obstructed when the site was inspected on 8 October?” Record who authorised access, its limits, the site or item identifier, and the planned viewpoints. Take an establishing view that locates the subject, a middle view showing its relationship to surrounding features and detail views for the disputed condition. Include a scale only if its size and placement are reliable; an uncalibrated photograph should not be used for a precise measurement. Note views you could not obtain, and why. Do not enter a restricted area or photograph private material merely to complete a shot list; assess authority and privacy before capture. The OAIC’s APP 3 guidance is relevant where an APP entity collects identifiable personal information. OAIC APP 3 guidance.
2. Keep a capture log that can be reconciled with the files
Create the log during or immediately after the visit. Use the camera’s actual filenames as well as any later exhibit numbers. Record the local time and time zone, and note any known device-clock error. Do not silently “correct” the image metadata. Include weather or lighting only when it could affect what is visible. A useful entry has:
- Assignment and authority: matter reference, site, purpose, person granting access and any area excluded.
- Capture: photographer, device and lens where relevant, file name, local date/time and time zone, viewpoint or marked plan reference, direction of view, and subject.
- Conditions and limits: lighting, weather, obstruction, distance, camera-clock discrepancy, missing view or interference.
- Handling: card/device source, transfer date/time, recipient, secure destination, original-file identifier and any integrity-check result.
Example capture-log entry — hypothetical
- Reference: EX-04; eastern loading route, Site B; access authorised by site manager for common yard only.
- File: DSC_0148.JPG; captured 8 October 2026 at 14:07 AEDT; photographer A; camera body C-2; view from marked point V3 looking east.
- Subject: entire route and temporary fencing; adjacent gate and fixed building corner included for orientation. Detail file DSC_0149.JPG shows the fencing at the gate.
- Limits: parked truck concealed the southern edge; no measurement taken; camera clock was approximately two minutes slow against a recorded reference clock.
- Transfer: files copied from card C-2 to restricted matter store at 16:20 AEDT by A; receipt checked by B; card retained pending the agreed preservation decision.
This is a worked format, not a real Sceáwian matter. A log entry supports an account of capture but does not independently prove the time, location or truth of everything depicted.
3. Preserve the received original and work on copies
Retain the file as first received from the device or source, including its original format and filename. Copy it to an access-controlled store, record the source and transfer, and restrict routine editing of that preserved version. Make a separate working copy for selection, cropping, exposure adjustment, redaction, annotation or report layout. Keep a mapping from each working or exhibit file to its source file. NIST’s digital-evidence guidance addresses source, chain of custody and storage; forensic image-capture guidance published by NIST calls for original images to be saved in native format and processing to occur on working copies. NIST IR 8387, section 3.2; SWGDOC image-capture standard, sections 7.7–7.9.
Record each material transformation: source filename, working filename, operator, date, software and version if material, steps taken, and purpose. A crop should be labelled as a crop; retain the uncropped source so a reader can see excluded context. If colour, contrast or sharpening affects a disputed feature, supply the unadjusted view alongside the processed one and seek an imaging specialist before drawing a technical conclusion. A redaction protects information in a disclosure copy but should not replace the preserved source.
4. Document transfers and use hashes for the question they can answer
For each hand-off, record who sent and received the files, when, by what route, which files or manifest were included, and where they were stored. If a SHA-256 or other hash is calculated, record the algorithm, value, file name, size, date/time, tool and person. Recompute it after a transfer when continuity is material. An identical cryptographic hash supports that the compared files are byte-for-byte the same; it does not establish who took the photograph, when or where it was taken, whether a scene was staged, or whether the device clock was right. A changed hash can arise from metadata changes or other processing and calls for investigation, not an automatic accusation. NIST discusses both hash use and what to do when comparisons fail. NIST IR 8387, section 3.2.
EXIF or other metadata may help orient an inquiry, but it can be absent, altered or based on an incorrect device clock. Compare it with the capture log, site records, contemporaneous communications and other independent observations. Avoid claiming that metadata alone authenticates an image.
Worked scenario — a disputed access route
Hypothetical example. A contractor says fencing blocked a delivery route on Thursday; the principal says the route was clear. The authorised photographer visits Thursday afternoon and makes an establishing image of the yard, a medium image linking the gate to the fence, and details of the gap. The log records the truck that obscured one edge and the two-minute camera-clock error. Originals are preserved; a labelled report copy uses a crop to make the gate easier to see. A second visit on Friday shows the fence moved.
What can be reported: the images and log support that the visible part of the route was obstructed at the Thursday visit and appeared clear at the Friday visit, subject to the obscured edge and verified capture context. What remains open: exactly when the fence moved, whether every delivery was prevented, who directed the move, and whether the condition breached a contract. Test those questions against delivery records, site diaries, access logs and witness accounts. If dimensions, geolocation or image alteration are contested, obtain appropriately qualified technical advice.
Before sharing a photographic evidence set
- Can the reviewer state the factual question, authority to capture and coverage gap?
- Does every selected image trace to an original filename and capture-log entry?
- Are originals retained separately from edited, annotated or redacted copies?
- Are edits and transfers recorded, and are hash values described only as file-integrity checks?
- Does the report separate visible observations from inference about cause, intent, timing or compliance?
Rules about relevance, authenticity, disclosure and admissibility depend on the forum and the issue. Ask the legal team to settle those questions for the matter; this workflow is designed to leave them a reviewable record, not to predetermine the answer. Evidence Act 1995 (Cth), current text.