Retrospective disclosure: This article covers the week ending June 4, 2026. It was prepared later, was not published during that week, and was first published October 15, 2026. Sources were rechecked October 15, 2026. Memphis Security Insider is independent and unaffiliated with the Memphis Police Department, the National Institute of Justice or the National Institute of Standards and Technology. This is an operations guide, not legal or forensic advice.
Five police case numbers. One agency announcement.
Those facts do not create one company incident file.
On June 2, the Memphis Police Department published its account of a May 31 investigation. MPD said investigators linked one arrested person to events spanning several days and cleared five separate criminal investigations. The department reported that charges had been filed and said the investigation remained ongoing. MPD’s June 2 announcement
Charges are allegations. An arrest or police clearance is not a conviction, and the public announcement does not provide a court disposition. This article omits the arrested person’s identity, the detailed allegations and the street-level sequence because none is needed to solve the records problem.
For a regional property manager or security director, the useful question is narrower: when an agency says reports from several places are linked, how do you show that link without rewriting what each site, witness, camera and access system originally recorded?
Put the link in an index, not in the source files
A cross-property timeline should point to the property records. It should never replace them.
Our later review of two May Winchester Road bulletins dealt with two reports that MPD did not connect. The June 2 announcement presents a different boundary: MPD itself stated that investigators linked five cases. That supports an entry labeled “MPD-reported link.” It does not permit a private operator to fill gaps in one property file with details from another.
Keep one incident packet for every site or operating unit under your control. Give each packet an internal identifier. Inside it, retain the original report, guard note, work order, access event, photograph or authorized video export with its own source label. Corrections should be appended with a date and author; old entries should not be edited into apparent perfection.
Then build a small master index:
| Master field | What to record | Boundary |
|---|---|---|
| Internal event ID | The company’s stable reference for that site packet | It does not replace an MPD case number. |
| Agency reference | The case or report number supplied by the agency, if available | Keep separate numbers separate, even when an agency reports a link. |
| Property and time range | The location code and period covered by that packet | A response time is not automatically the event or discovery time. |
| Link source | Who asserted the connection, when, and in which record | Write “MPD-reported” when MPD is the source. Do not shorten it to “confirmed.” |
| Record custodian | The person or system responsible for the original | A person who can view a file is not necessarily authorized to release it. |
| Open question | The mismatch or missing fact that still needs review | Blank space must not become a guess. |
That index can show five linked police references while preserving each property’s distinct history. Simple. Also easy to get wrong under pressure.
Separate the clocks before they disagree
The master row should not pretend that every timestamp describes the same moment.
A property event may produce an alarm time, a door-controller time, a guard’s observation, a 911 call, a police response, a video display time and an export time. Put each on its own row with the source system, time zone and person who recorded or retrieved it. If the recorder clock appears four minutes slow, keep the displayed time and document the observed difference. Do not silently “fix” the original entry.
The same rule applies to human accounts. “I saw the door open around 2 a.m.” is a recollection. A credential event stamped 2:03:18 a.m. is a system record. Neither should be dressed up as the other, and a later camera review should not be copied into the witness’s original note.
A multi-property file can go sideways at that step. A corporate reviewer sees similar times, rounds them to the same hour and writes a clean narrative. The neat version may be easier to read. It is harder to audit.
Use two time columns if the team needs a normalized view: source time and working comparison time. Record the adjustment rule. Keep the source time untouched. A reviewer can then compare systems without losing the path back to the original.
Evidence handling starts with restraint
Property staff should preserve what they lawfully control and leave collection and scene processing to authorized investigators.
The National Institute of Justice warns that responders who do not work methodically can contaminate or lose evidence. Its law-enforcement guide says agency policy, law and local conditions govern the procedure. For a private property team, that is a reason to secure the area, record immediate observations, restrict unnecessary access and ask the responding agency what it needs. It is not permission to move, package or test possible evidence. NIJ crime-scene guidance
Do not follow a suspected vehicle, send an employee to another property to verify a sighting or confront anyone to make the timeline more complete. Call 911 in an emergency. Give dispatch the current location and safe, direct observations. The gap in the worksheet can wait.
NIJ’s chain-of-custody training lists the core details investigators track: a unique identifier, an item description, who collected it, when it was collected and where it was found. It also calls for limiting handlers and documenting transfers. NIJ chain-of-custody training
A company log is not a substitute for an agency chain-of-custody record. Still, the same questions expose a weak handoff. Who had the export? Where did it come from? When did it change hands? What version went to the investigator?
For digital files, NIST advises documenting the original source and how a file was created or transferred. Its guidance discusses hashes, early copies, secure storage, authentication, access controls and logging. The primary audience is evidence-management professionals. A property manager should use trained staff, written policy and investigator instructions rather than improvise a forensic workflow. NIST digital-evidence preservation guidance
One practical split helps: preserve the original authorized export and make a separate viewing copy. Record both. Do not crop, annotate, compress or forward the preserved file through a group chat just because a regional team wants a quick look.
Share the minimum record each role needs
A regional timeline can become a privacy problem faster than it becomes an investigative aid.
The master index rarely needs a witness’s home address, date of birth, personal phone number or a copied identification document. Keep sensitive information in the controlled source packet when the business has a lawful reason to retain it. Use role-based access. A building engineer who must preserve a door log may not need a witness statement; a supervisor checking a schedule may not need the video.
The same restraint applies to descriptions and tentative matches. If an investigator asks the company to preserve a specific vehicle, asset or credential reference, record the request and route it to the people who control the relevant systems. Do not circulate a homemade alert that turns an unverified similarity into an accusation.
Every outside transfer needs a short receipt in the company record: what was provided, the source packet, who authorized it, who received it, the date and time, and the transfer method. Follow applicable policy, legal process, insurer instructions and qualified counsel’s advice. If the agency gives a different instruction, record it and identify the person who received it.
No mystery folder named “all evidence.” The file name may feel efficient on day one. By day thirty, nobody can tell which property supplied which clip.
Run a contradiction review before writing the narrative
The first management review should look for conflicts, not force a conclusion.
Start with the five questions that can break the record:
- Does every agency number still point to the applicable property packet or packets?
- Does every time state its source and time zone?
- Are observations, system records and agency statements labeled differently?
- Does each copied file have an identified original, custodian and transfer history?
- Is every claimed connection attributed to the person or agency that made it?
If two sources disagree, keep both. Add a review note. A guard’s 1:58 a.m. entry and an access system’s 2:04 a.m. event may describe different actions, use different clocks or contain an error. The manager’s job is to preserve the disagreement so the authorized reviewer can resolve it.
Status language needs the same discipline. Internally closed may mean that a repair is finished or an insurer received the packet. MPD’s word “cleared” describes the agency’s stated case status; it does not mean a court found someone guilty. Use separate fields for property action, police status and court outcome. If the court outcome has not been verified, write “not verified.”
MPD’s June 2 announcement ends by saying the investigation remained ongoing and does not link to a court disposition. That describes the agency page, not what a court later decided. Nothing in this operations guide depends on the accused person’s current status.
The June announcement supports one limited fact: MPD said its investigation linked five separate case numbers. A property team can preserve that statement, the applicable source files and the boundaries between them at the same time.
A link belongs in the index. The originals stay where they came from.