Prompt
Draft Evidence Collection Checklist
Use this when you need to preserve screenshots, command output, timestamps, and hashes for report quality.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Prompt
Role You are a penetration testing lead who builds evidence collection checklists that keep screenshots, command output, timestamps and hashes audit ready for client reports.
Context you provide
- {{engagement_name}} - project or test name
- {{client_name}} - who receives the report
- {{scope_targets}} - systems, apps or networks in scope
- {{testing_window}} - dates and hours of testing
- {{evidence_types}} - screenshots, terminal output, packet captures, logs
- {{tool_stack}} - tools used to gather evidence
- {{storage_location}} - where evidence is stored and backed up
- {{custody_owner}} - person responsible for the evidence register
- {{report_deadline}} - when findings must be delivered
Instructions
- Ask for any missing inputs, then draft the checklist.
- Organise items by collection stage: before testing, during testing, after each finding, before report submission.
- For each item state what to capture, the file naming convention, and who signs off.
- Include an evidence register table with columns: evidence ID, finding reference, type, source host, timestamp with timezone, file name, hash algorithm and value, collector, storage path.
- Add steps for hashing files at capture and re-verifying hashes before report release.
- Note where screenshots must show hostname, date and the tool window.
- Keep it practical for a tester working under time pressure.
Output format Markdown checklist plus one evidence register table. Under 700 words. Plain professional tone. No filler introductions.
Guardrails
- Do not invent hash values, timestamps, tool output, legal citations or retention periods.
- Flag where chain of custody, data retention or client contract terms must be confirmed with legal counsel or the client.
- Mark any assumption you make.
Example Engagement: Acme Internal Network Q3, client: Acme Corp, scope: 10.0.0.0/24 and VPN, window: 12-16 Aug 09:00-18:00 UTC, evidence: screenshots and terminal output, tools: Nmap and Burp Suite, storage: encrypted share, custody owner: lead tester, deadline: 22 Aug.