Building the Defence Case

1. The investigation continues on two tracks

After release, the state continues to investigate. Officers may obtain statements, examine devices, recover CCTV, commission forensic work, seek third-party records and obtain charging advice. The defence cannot see every step and should not pretend to reconstruct the entire police file from fragments.

At the same time, the defence can build an independent understanding of the allegation. That does not mean creating a rival police force or collecting everything that might conceivably help. It means identifying what may affect the next decision and ensuring that reliable material is not lost, misunderstood or left untested.

2. What a defence case is

A defence case is a changing evidential model. It connects the legal issues, the client’s reliable account, the available sources, the weaknesses in competing explanations and the consequences of acting or remaining silent. It must be capable of change. A theory that cannot survive an inconvenient fact is not a theory; it is a commitment.

The immediate aim is rarely to prove the whole case. It is to improve the quality of the next decision: whether evidence is preserved, a witness is approached, a record is obtained, an expert is consulted, investigators are notified, a further interview is accepted or representations are made.

3. Start with issues, not documents

A client may arrive with thousands of messages, a long grievance history and a firm view that one item proves everything. Beginning with the material alone creates noise. Begin instead with the propositions that may matter.

• What offence, regulatory breach or other allegation appears to be under consideration?
• Which act, omission, identity, state of mind, circumstance or consequence may have to be proved?
• What account has the client already given, formally or informally?
• What appears agreed, disputed, inferred or genuinely unknown?
• What immediate decision is approaching, and which propositions can affect it?
• What wider objective identified in Chapter Three must be protected alongside the criminal case?

The issue list should remain provisional. Disclosure may be limited. The suspected offence may change. A fact that initially appeared central may become peripheral. The purpose of the map is to direct attention, not to freeze the case prematurely.

4. Take instructions that can withstand later scrutiny

The first detailed proof should be taken in conditions that permit concentration, candour and correction. The client should understand that accuracy is more valuable than fluency. “I do not remember”, “I assumed”, “I learned that afterwards” and “I may be wrong about the time” are legitimate answers where true.

For each important proposition, separate four things: what the client personally perceived; what the client inferred at the time; what somebody else later said; and what documents or digital records now appear to show. Mixing those categories can turn later knowledge into an apparently contemporaneous memory.

• Record the source of knowledge: seen, heard, done, received, inferred or later learned.
• Use the client’s own vocabulary before introducing legal language.
• Test dates and sequence against anchors such as journeys, calls, payments, meetings and routine events.
• Record uncertainty and competing possibilities rather than choosing the neatest account.
• Identify earlier accounts, deleted material, embarrassing facts and apparent inconsistencies expressly.
• Ask what evidence would be expected if the account were correct and what might contradict it.
• Keep a dated record of material corrections and why the account changed.

5. Build a source-led chronology

A chronology is not a prose story broken into dates. It is an analytical instrument. Each entry should identify the time or range, the event asserted, the source supporting it, the confidence level, any conflict and the question that follows.

Four times may differ: when the event occurred; when it was recorded; when the defence obtained the record; and when someone first asserted its significance. A message created at 20:10, downloaded months later and interpreted only after interview has three different evidential dimensions. Collapsing them obscures both reliability and hindsight.

• Use precise times only where the source supports precision.
• Preserve original time zones, clock drift and daylight-saving issues where relevant.
• Place competing accounts alongside one another rather than silently choosing between them.
• Mark gaps openly. Absence of a record is not automatically proof that an event did not occur.
• Link each significant entry to its source location so the chronology can be audited.
• Maintain a separate list of propositions that the chronology tests or leaves unresolved.

The chronology should expose difficulty. If it merely makes the client’s case look orderly, it is being used as advocacy too early.

6. Create a material map, not a document heap

Potential defence material commonly includes communications, CCTV, access records, location data, photographs, financial records, work systems, medical material, vehicle data, calendars, recordings and physical items. The first question is not whether an item looks helpful. It is what proposition the source can reliably bear upon.

A material map should record the source, controller, date range, current location, preservation status, method of acquisition, integrity concerns, relevance, adverse features and proposed next step. This prevents the same screenshot being treated simultaneously as original evidence, complete context and proof of identity when it may establish none of those things without further work.

7. Preserve before deciding how to use

Evidence often disappears through ordinary systems: CCTV overwrites, cloud retention periods expire, vehicles are repaired, work accounts close and memory changes. Preservation may therefore be urgent even when deployment would be premature.

• Identify the person or organisation controlling the original.
• Request preservation in neutral terms where appropriate, without inviting alteration or coaching.
• Keep native files and full exports where possible, not only screenshots or selected clips.
• Avoid opening, editing, renaming or forwarding files in ways that unnecessarily change metadata.
• Record who obtained the material, when, from where and by what method.
• Preserve surrounding context and inconvenient content, not merely favourable extracts.
• Store a working copy separately from the preserved original.
• Do not access an account, device, workplace system or premises without lawful authority.

Preservation is not disclosure. Nor is it a decision to rely. Once the source is safe, the defence can assess legality, relevance, privilege, privacy, completeness and strategic effect before deciding who should examine or receive it.

8. Decide who should obtain the evidence

Sometimes the strongest defence step is to invite investigators to obtain the original. That may be appropriate where police powers are required, the source is independent, continuity matters, disclosure obligations should attach, or defence contact could compromise safety or reliability. A precise request should identify the source, relevance, risk of loss and enquiry proposed.

Direct defence collection may be appropriate where the client lawfully controls the material, urgent preservation is necessary, investigators have declined or delayed, or confidential analysis is required before deciding whether to deploy it. The method must remain lawful, proportionate and recorded.

The investigator’s duty is to pursue reasonable lines of enquiry towards and away from the suspect. It is not a duty to pursue every speculative possibility. A useful defence request therefore does more than say “check the CCTV”. It explains which camera or system, what period, what proposition it may test and why the source may reasonably contain relevant material.

9. Witnesses: protect independence before content

A potential witness is not simply another source to be harvested. The first strategic question is who the person is and what risks accompany contact. The witness may be independent, aligned with the client, employed by the client, vulnerable, a complainant, a co-suspect, represented separately or subject to an order or restriction.

Before any approach, establish the purpose. Is the immediate need merely to preserve contact details and prevent loss of footage or records? Should investigators be invited to take the account? Is a defence proof necessary to understand evidence that will otherwise remain unavailable? The least contaminating effective step is usually the best starting point.

• The client should not interview the witness, send a suggested account or ask for “support”.
• Do not tell the witness what another witness has said before obtaining their own unaided account.
• Identify who is acting, whom they represent and that the witness must give their own truthful account.
• Use neutral, open questions before testing detail; do not reward, threaten or pressure.
• Record the approach, persons present, questions, answers, documents shown, breaks and later corrections.
• Preserve the witness’s own words and material inconsistencies; do not improve the language.
• Consider conflict, confidentiality, safeguarding, representation and whether police contact would carry greater independence.
• Stop and seek specialist advice if contact may breach bail, an injunction, a restraining order, professional rule or criminal law.

10. Complainants, vulnerable witnesses and co-suspects

Direct or indirect contact with a complainant is particularly sensitive. Even apparently invited communication may be misunderstood, breach a restriction, affect safeguarding, create a new allegation or compromise the evidence. Where information must be preserved or a genuine communication addressed, it should ordinarily be managed through lawyers or investigators after the risks and lawful route have been considered.

Vulnerability may arise from age, mental health, disability, trauma, dependency or communication need. It affects whether an approach should occur, who should conduct it and how reliability can be protected. The pursuit of favourable evidence never justifies avoidable harm or pressure.

A co-suspect may have overlapping interests today and conflicting interests tomorrow. Sharing accounts, documents or strategy can contaminate evidence, waive confidentiality and create allegations of coordination. Separate representation and a conflict analysis may be required before any exchange.

11. Digital material: content is only the beginning

Digital material creates an illusion of objectivity. A screenshot appears exact, a location point scientific and an account name personal. Each may still require attribution, completeness and interpretation. The defence should separate the content displayed from the device or account that produced it, the person who used it, the method of extraction and the surrounding data.

• Identity: who created, sent, received or controlled the account or device?
• Completeness: is the item a full conversation, native export, selected screenshot, transcription or reconstruction?
• Time: what clock, time zone, server event or device setting produced the timestamp?
• Context: what preceded and followed it, and what other channel may have been used?
• Integrity: has the file been edited, compressed, forwarded, cropped or re-saved?
• Interpretation: does the data prove presence, use or knowledge, or merely device or account activity?
• Collection: who obtained it, with what access and what audit trail?
• Adverse material: what else in the same source qualifies or contradicts the proposed point?

The client should be warned not to delete, reset, remotely wipe, edit or manufacture digital material. Where technical questions may matter, preserve first and obtain forensic advice before repeated handling changes the source.

12. Documents, records and retrospective reconstruction

Business and professional investigations often turn on records created for operational purposes rather than litigation: policies, approvals, audit logs, minutes, emails, invoices, clinical notes, rota data and access records. Their value may lie in ordinary contemporaneous creation. A document produced after the allegation to explain what “must have happened” is different evidence and should be labelled honestly.

Do not backdate, rewrite, complete or silently correct an existing record. If a later explanatory note is genuinely required, it should state who created it, when, from which sources and for what purpose. The original should be preserved. The same discipline applies to annotated screenshots, reconstructed spreadsheets and merged message threads.

13. Expert triage before instruction

Expert evidence is justified by a defined question outside ordinary knowledge, not by the seriousness of the allegation or a hope that science will find an answer. Before instruction, identify the proposition, available data, relevant expertise, assumptions, limitations, timetable and decision the opinion may affect.

An early consultation may reveal that the issue does not require expert evidence, that the underlying data are inadequate, that a different discipline is needed or that further preservation must occur immediately. It may also produce an unfavourable opinion. The legal consequences of instructions, drafts, unused opinions, expert independence and later deployment require careful treatment and are addressed in Chapter Twelve.

14. Test the defence theory against the hard material

Good defence preparation is deliberately disconfirming. Once a provisional explanation emerges, ask what evidence ought to exist if it is true, what evidence would weaken it, which fact is being explained only by assumption and which innocent explanation also fits the prosecution material.

• Identify the strongest item apparently supporting the allegation and confront it directly.
• List facts the client accepts even though they appear unhelpful.
• Separate “not proved” from “proved false”; they are different propositions.
• Ask whether the alternative account explains the whole pattern or only one isolated item.
• Test attribution, timing, opportunity, state of mind and context independently.
• Record enquiries that failed or produced neutral or adverse results.
• Revise the theory when the evidence changes; do not revise the evidence to protect the theory.

This is where the defence earns authority. A case that has survived fair internal challenge can be presented with precision. A case protected from challenge may collapse when investigators ask the first question the defence avoided.

15. Keep a gap and decision register

Uncertainty should be managed, not hidden. A gap register records what is not known, why it matters, who may resolve it, the risk of waiting and the date for review. It prevents repeated unstructured searches and makes clear when an inference has been mistaken for evidence.

Alongside it, keep a decision record for material steps: approach or do not approach a witness; preserve only or collect; ask police to obtain a source; commission technical work; postpone contact; prepare for further interview; or move towards representations. The record should identify the objective, known facts, risks, alternatives and review trigger.

16. Two practical examples

Example one: the favourable witness

A professional client identified a colleague who appeared able to contradict an important part of the allegation. Immediate contact by the client would have created a risk of perceived coordination and could have affected the colleague’s employment position. The defence first preserved the witness’s identity and the existence of related work records, then assessed independence and requested that investigators obtain the account and original system data. The evidential value came not from a polished defence statement, but from an independently recorded account supported by records created before the allegation.

Example two: the apparently decisive screenshot

A client produced a screenshot that seemed to resolve the timing of a disputed exchange. Review of the full export showed that the image omitted adjacent messages and that the displayed time reflected a different device setting. Preserving the screenshot was still useful because it recorded what the client had originally seen. Treating it as the complete source would have weakened credibility. The defence obtained the native material, corrected the chronology and reframed the point more narrowly before any deployment decision was made.

17. The case-building review

• Issue: Which proposition can affect the next police, prosecutorial, regulatory or safeguarding decision?
• Account: What does the client personally know, and what remains inference, later information or uncertainty?
• Material: Which original source bears upon the proposition, including material that may be adverse?
• Test: What proportionate enquiry can confirm, qualify or contradict the working account?
• Gap: What remains unavailable or unsafe to infer, and what is the consequence?
• Action: Who should preserve, obtain, examine or request the material, and under what lawful authority?
• Review: What has changed in the case theory, and what decision now follows?

At the end of the review, the defence should be able to state the present case in measured terms: the propositions that matter, the reliable evidence available, the weaknesses acknowledged, the enquiries still required and the reason for the next proposed step.

Legal source note

Law and professional standards checked to 3 August 2026. This chapter has been checked principally against the Criminal Procedure and Investigations Act 1996 Code of Practice, especially paragraphs 3.5 and 3.6 on reasonable and non-speculative lines of enquiry and paragraph 4 on recording; the Attorney General’s Guidelines on Disclosure 2024; the SRA Principles and Code of Conduct for Solicitors, particularly the duties not to mislead, misuse or tamper with evidence, or seek to influence its substance; and Part 19 of the Criminal Procedure Rules 2025 concerning expert evidence. Detailed privilege, expert-disclosure and ethical-boundary analysis is deliberately reserved for Chapter Twelve.