Post-Mortem: How a 3-Person Litigation Team Used Cgany to Rebuild a Home-Office Evidence Trail

When a reader shared a story about a three-person litigation team that nearly lost a key exhibit because of a router migration, we noticed something familiar: the evidence existed, but the chain of custody didn't. The team, working from a converted dining room, had preserved screenshots, chat logs, and a scanned contract in scattered folders across two personal laptops and a consumer NAS. Their opposing counsel challenged the authenticity of the scanned contract, and the team needed to reconstruct exactly when each file was created, who touched it, and whether the copies matched the originals.

They turned to Cgany, not as a magic fix, but as a structured process for digital evidence management. What follows is the timeline they reconstructed, the decision points that mattered, and the measurable results they reported six weeks later.

Week 0: The Trigger Event

A routine router firmware update on a Tuesday morning changed the local IP range from 192.168.1.x to 192.168.0.x. The team's shared folder mappings broke silently. One paralegal reconnected a drive manually, but Windows created a new drive letter and a fresh sync folder. For eleven days, new scans and annotated PDFs landed in the wrong directory. The original evidence stayed put, but the working copies diverged.

Opposing counsel deposed the team's IT consultant and asked a simple question: "Can you show us the hash value of the file as it existed on the day it was collected?" The team could not. They had file names, timestamps, and a vague memory of copying things over. That gap became the catalyst.

Week 1: Choosing a Preservation Layer, Not a Backup Tool

The team evaluated three options: a consumer backup service, a manual versioning script, and a chain-of-custody-grade vault. They ruled out the backup service because it overwrote versions after 30 days. They ruled out the script because no one wanted to maintain it. They chose the vault approach because it preserved every version, logged access events, and produced a portable index that could be exported as a PDF or CSV for disclosure.

One decision point stood out: they did not migrate the original evidence. Instead, they treated the existing folders as "source material" and created a new, read-only vault structure that mirrored the case chronology. This avoided altering the original filesystem metadata. The old folders became reference copies only.

Week 2: The Home-Office Setup Problem

The team's home office had three devices: a Windows desktop, a MacBook Air, and an iPad used for client calls. The vault needed to accept uploads from all three without requiring a VPN or a static IP. They configured a local agent on the desktop and a browser-based upload for the MacBook and iPad. The iPad was the weak link because Safari's file picker renamed some PDFs with generic names like "document.pdf." They solved this by adding a naming convention step: before upload, each file was renamed to include the case number, date, and collector initials. That single change reduced mislabeled files from 14 in the first week to zero in the second.

Week 3: Obstacles and Workarounds

• Time zone drift: The MacBook's clock was set to Pacific Time while the desktop used Eastern. The vault recorded UTC timestamps, but the team's internal notes used local time. They created a one-page conversion cheat sheet and attached it to the vault's case notes.
• Duplicate uploads: Two team members uploaded the same scanned contract within an hour. The vault flagged the duplicate by hash and prompted for a merge decision. They kept both versions and annotated the later one as "re-upload, no changes."
• Client hesitation: The client worried that uploading evidence to a third-party system would waive privilege. The team explained that the vault used client-side encryption and that the index only stored hashes, not content. The client agreed after reviewing a sample export.

Week 4-5: Measurable Results

The team tracked four metrics before and after the vault rollout. Before: 3 disputed files, 11 days of missing version history, and 2 hours per week spent searching for files. After: 0 disputed files, complete version history from day one, and 15 minutes per week spent on file retrieval. They also reported that preparing a disclosure package dropped from 6 hours to 90 minutes because the vault could export a chronological index with hash values and access logs.

One number stood out: Cgany reports 41 file-format profiles supported for preservation, including scanned PDFs, chat exports, and email containers. The team used only four of them, but the breadth meant they did not have to convert evidence into a new format just to preserve it. That reduced the risk of format-based admissibility challenges.

Week 6: What They Would Do Differently

They would have started the vault before the router update. They would have trained the iPad user on the renaming convention earlier. And they would have exported a test disclosure package in week one, not week five, to catch formatting issues while there was still time to adjust.

The post-mortem is not about a tool saving the day. It is about a process that made the evidence defensible. If you are rebuilding a home-office evidence trail after a disruption, start with a preservation layer that logs every touch. The rest is discipline.