01
Specify what is missing first.
“More data is needed” is not enough to move an investigation forward. Identify the claim to examine, the assumption still open, or the information that could change the analysis. The missing material belongs alongside the question it is meant to resolve.
Evidence Pursuit in HARBINGER includes source and route discovery, prioritization, and investigation planning. A proposed investigation identifies the next useful material for the current question, rather than treating more collection as an end in itself.
02
Examine routes alongside access conditions.
Finding a location where material may exist is different from having permission to access it. Public sources, customer-provided records, and material obtained through external tools each have access conditions and a party responsible for acquisition.
An investigation plan includes those distinctions. Separating the route from the authority and conditions for acquisition also helps distinguish unavailable information from a blocked route. Discovering a route does not grant permission to use it.
03
Acquired material returns to the analysis.
After material is obtained, its origin and acquisition context need to be retained and its use as evidence examined. HARBINGER distinguishes acquisition, preservation of source material and its context, admission as evidence, and downstream analysis. Obtaining a file does not complete the analysis.
The new evidence is connected back to the original question. It may support an assumption, challenge it, or raise another question, informing the analysis and the proposed next investigation. Actual source connections and acquisition methods depend on the selected customer and mission configuration.