Collecting and preserving evidence developed during an on-line investigation. Evidence gathered on-line is hashed with a time stamp from an external time source and stored. Other data pertinent to an investigation is also stored and may also be hashed. The evidence may be presented later in a report that demonstrates the authenticity of the evidence. A computer system for on-line investigations includes a CPU, memory, input/output facilities, a communication element, and a security element such as a dongle. Communication software enables the investigator to communicate over the Internet and gather evidence. Investigation software enables the computer system to store and hash the evidence; this may be done automatically. A database structure includes tables for investigator and suspect data, cases, evidence, and provision for storing a time stamp indicating when the evidence was collected.