Cold Case Evidence and File Review: What a PI Looks For

The first real work of any cold case investigation is reading the original case file. It must be done carefully, patiently, and with a specific set of questions in mind. A qualified investigator can often tell within the first full read-through whether the case is workable, what the most productive lines of inquiry are, and where the original investigation went wrong. This article walks through how an experienced cold case investigator actually reviews a case file.

What Is Actually in a Case File

A typical homicide or major-crimes case file contains:

• Initial incident report and supplemental reports from responding officers
• Detective reports and investigative summaries, including timelines and suspect theory narratives
• Witness statements, recorded interviews, and interview transcripts
• Crime scene documentation: photographs, sketches, measurements, evidence collection logs
• Forensic reports: autopsy, toxicology, trace evidence, DNA, firearms, any specialized analysis performed
• Subpoena returns: phone records, financial records, employment records
• Search warrant applications and returns
• Polygraph results (if any)
• Prior agency correspondence: referrals, task force documentation, inter-agency coordination

The file is rarely in one place. A thorough investigator confirms what exists, requests it formally, and reconstructs what has been lost or separated.

What a Qualified Investigator Looks For

A file review is not casual reading. An experienced investigator works through the file with specific questions and annotates as they go:

Timeline Integrity

Does the investigative timeline actually reconstruct consistently from the source documents? In many cold cases, the narrative timeline in the detective's summary contains inferences or approximations not supported by the underlying statements and records. Reconstructing the timeline strictly from primary documents is often where cold cases break open. Noting where the narrative departs from those documents is part of that work.

Witness Coverage

Who was interviewed, and who was not? The investigator reads every witness statement and cross-references it against any named individuals elsewhere in the file. New information often lives with peripheral figures who were mentioned but never approached: family, friends, co-workers, neighbors, and associates. In a long-term cold case, those people may now be willing to talk when they were not originally.

Physical Evidence Inventory

What was collected, what was tested, what was retained, and what is still available? The investigator builds a complete inventory from the collection logs and cross-references it against forensic reports. Evidence collected but never tested is a priority. So is evidence tested with older methods that might benefit from modern analysis.

Unfollowed Leads

Every cold case file contains leads that were recorded, considered, and not pursued. The investigator catalogs these carefully. Some were not pursued because they were clearly unproductive at the time. Others were dropped due to resource constraints, a detective retiring, or the case being deprioritized. The latter are the ones worth working now.

Theory of the Case

What did the original investigators believe happened? Was that theory tested against alternatives? In some cold cases, an early theory took hold and shaped all later investigation. Evidence inconsistent with the theory was deprioritized or dismissed. A fresh review with no commitment to the original theory sometimes surfaces alternatives that were never seriously considered.

Documentation Quality

How well-documented was the original work? A thorough file is an asset. A fragmentary file is a constraint, and reconstruction work has to come first before new investigation is productive. The investigator's assessment of documentation quality drives much of the initial case assessment provided to the family.

Writing the Case Assessment

After a full file review, the qualified investigator produces a written case assessment for the client. It typically covers:

• Summary of the original investigation and where it ended
• Status and quality of the preserved evidence
• Assessment of which lines of inquiry are most productive going forward
• Estimate of the scope, timeline, and cost of a phase-one investigation
• Honest evaluation of case viability, including the possibility that the case cannot realistically be solved

The case assessment is where the investigator earns the family's trust. An honest assessment, including hard news when warranted, is worth far more than an optimistic one that cannot be supported.

When Records Are Not Available

Some case files are incomplete, damaged, or partially lost. The investigator's job then is to reconstruct what can be reconstructed from secondary sources:

• Media coverage
• Court records
• Prior FOIA responses
• Interviews with original investigators where possible
• Public records from the jurisdiction

A reconstructed file is never as good as the original. It is often enough, however, to identify a few specific, productive lines of investigation.

The Value of the Review Itself

Families sometimes ask whether a file review is worth the cost when it is just "reading." The file review is where an investigator earns or loses the rest of the engagement. An investigator who has read the file carefully can articulate specifically what they propose to do, why, and what it will cost. An investigator who has not cannot. The review is the foundation everything else is built on.

Encyphir's cold case investigations team begins every engagement with a full file review. We often draw in digital forensics specialists and law firm co-counsel when the file points toward preserved digital evidence or a renewed path to prosecution.

How Investigators Obtain the File in the First Place

Getting access to a case file is itself part of the work. In most jurisdictions, an active investigation, even a dormant one that has never been formally closed, is exempt from standard public records disclosure. Families and their investigators typically pursue access through several channels in parallel. The first is a direct request to the investigating agency, often through a meeting with the current cold case unit commander or the detective of record. Some agencies are receptive to outside investigators working in coordination with them. Others are guarded, particularly when the original handling of the case was flawed.

Where the agency will not share the file directly, the investigator works with family members to request copies of materials the family is legally entitled to:

• The death certificate
• The autopsy report in jurisdictions where it is a public record
• Any court filings
• Any materials produced during civil proceedings

Where a criminal case was charged and later dismissed or tried to acquittal, the court file is often the richest source of preserved investigative material. When families are represented by counsel, a civil wrongful death action can sometimes compel production of materials that were otherwise unavailable. That strategic path is one reason our law firm engagements so often involve parallel investigative and litigation work.

Re-examining Forensic Evidence With Modern Methods

A productive category of cold case work is identifying preserved physical evidence that can now be tested in ways that were not available when the case went cold. DNA analysis has advanced dramatically over the past two decades. Samples that produced no usable profile in 1995 or 2005 can now yield results through low-copy-number techniques, Y-STR analysis, or investigative genetic genealogy. Touch DNA from handled items, cigarette butts, clothing, and vehicle interiors has solved cases that stalled for thirty years.

The file review is where candidate items are identified. The investigator builds a list of every piece of evidence collected, cross-references it against the evidence retention records of the relevant property room, and flags items still available and suitable for testing. Cases involving electronic devices often run through our digital forensics team. They can sometimes recover data from pagers, early mobile phones, and seized computers that the original agency lacked the capability to examine at the time.

This work requires care. Evidence that has been improperly stored, repeatedly handled, or contaminated during prior testing may no longer be viable. The investigator has to manage family expectations about what a forensic re-examination can realistically produce. A written inventory with a candid assessment of each item's testing potential is worth far more than a general promise of "new forensic work."

Re-interviewing Witnesses Years Later

Witnesses change over decades. Relationships end and loyalties shift. People who were afraid of someone thirty years ago may no longer have reason to be. People who protected a friend or family member in their twenties sometimes reconsider in their sixties. A thorough file review identifies not only who was interviewed but also the quality and depth of those interviews. A person questioned once for twenty minutes in 1998 and never revisited is often a priority for re-contact, particularly when the file shows they had knowledge the original detective did not fully develop.

Re-interviews are delicate work. The investigator has to locate the witness, approach them appropriately, and conduct the interview in a way that preserves its evidentiary value if the case is ever reopened for prosecution. Poorly conducted re-interviews can taint testimony and create impeachment material that harms the case later. Experience matters here. Our background investigations capability is useful simply for locating witnesses who have moved, changed names, or deliberately become hard to find.

Coordinating With the Agency of Record

A cold case investigator working for a family is not a replacement for law enforcement. Only law enforcement can make an arrest, get a search warrant, or present a case to a prosecutor. The investigator's job is to develop information that the agency of record can act on, and to present it in a form the agency will take seriously.

That coordination is a skill in itself. Some cold case units welcome outside work; others resent it. The investigator who approaches the agency with a well-organized package, specific investigative proposals, and a clear understanding of the limits of their role is far more likely to get cooperation. The alternative is arriving with accusations about how the case was originally handled. Building that working relationship is often the quiet difference between a case that generates new leads and a case that generates friction.

Starting a Cold Case Review

Families considering a cold case investigation should expect an initial conversation, a review of what records the family already has in hand, and a written scope for the file review phase before any substantive investigative work begins. That phased structure protects the family financially. It also ensures that investigator and client alike share a realistic understanding of what the case looks like before larger commitments are made. Families ready to begin can contact us or review our engagement process to understand what the first steps involve.