A complete operational reference for law enforcement and investigative teams — how Hubstream structures a criminal investigation from first report to case disposition, and what data gets captured at every stage.
Every criminal investigation moves through six stages — from first report to case disposition. Here's how Hubstream structures that journey for investigative teams.
A new investigation opens when a report is received — from patrol, a tip line, a crime report form, a referral from another agency, or a proactive intelligence lead. Each intake channel maps to a structured form that captures the minimum required data: incident type, location, time, and initial parties. A case record is created automatically and assigned a case number.
Incoming cases are reviewed and prioritized by a supervisor or triage workflow. Priority is scored based on crime type, severity, available evidence, and whether a suspect is identified. Cases are assigned to the appropriate unit or investigator, with workload visibility across the team dashboard. High-priority or multi-agency cases can be escalated immediately.
The investigator builds the case — collecting physical and digital evidence, recording witness and victim interviews, identifying and profiling suspects, and running link analysis. Hubstream's DataSpace connects persons, locations, vehicles, organizations, and prior cases into a network graph, surfacing patterns and associations that are invisible across disconnected records. Prior contacts, known associates, and geographic patterns are automatically surfaced from existing case data.
With a suspect identified, the team builds the evidentiary case. Warrant applications are tracked within the case record, along with surveillance logs, controlled buys, and undercover operation notes where applicable. All legal authorities and their status are logged — search warrants, arrest warrants, court orders — with expiry tracking and renewal alerts. Co-conspirators and associated networks are developed in parallel.
At arrest, the case record is updated with the booking record, charges, and arresting officers. Hubstream auto-generates the prosecution referral package — case summary, evidence inventory, witness list, and timeline — formatted for the District Attorney or Crown Prosecutor. Charges are tracked through the court system with hearings, continuances, and plea negotiations logged against the case.
When a case closes, the outcome is logged — conviction, acquittal, plea, case dismissed, or suspect deceased. All outcomes feed the analytics dashboard: clearance rates by crime type, investigator caseload trends, geographic hot spots, and repeat offender patterns. Intelligence generated during the investigation — gang affiliations, criminal networks, known locations — is retained in the system and made available to future investigations.
Every entity in Hubstream's Crime Investigation template — what it represents, what fields it holds, and how it connects to the broader case record.
The central record every other entity links to. Tracks the lifecycle of a single criminal case from intake to disposition.
The initial report that opened the case — patrol report, tip, or referral. Preserves the original account before investigation begins.
An individual under investigation. May be unidentified (John Doe) at case open, with identity confirmed as evidence develops.
An individual harmed by the crime. Linked to the case and to any witnesses or persons of interest they have a relationship with.
An individual who observed the crime or has relevant information. Interview records and credibility notes are attached to the witness record.
Any item — physical, digital, or documentary — collected to support the investigation. Chain of custody is maintained on every evidence record.
A criminal organization, gang, or group connected to the case. Enables network analysis across cases involving the same organization.
A physical location relevant to the case — crime scene, suspect residence, stash house, or place of business.
A vehicle connected to the case — used in the crime, registered to a suspect, or identified via license plate reader or witness account.
A weapon recovered, seized, or linked to the crime — firearm, edged weapon, or other instrument. Ballistic and forensic data attached.
A legal authority obtained during the investigation — arrest warrant, search warrant, or court order. Tracked from application through execution.
The legal record of an arrest and subsequent court proceedings — charges, hearings, pleas, and final disposition.
The relationship paths that surface patterns across cases — the connections that turn individual records into an intelligence picture of criminal networks.
When a suspect is added to a case, Hubstream automatically surfaces any prior cases they appear in — as a suspect, a witness, or an associate — giving investigators an immediate view of criminal history and patterns.
Associates linked to a suspect are surfaced from across the case database — identifying co-conspirators, gang members, and network connections that span multiple investigations and units.
Individual suspects are linked to criminal organizations or gangs, allowing investigators to see membership patterns, hierarchy, and the full scope of criminal activity tied to a network — not just a single case.
A single address connected to multiple cases — as a crime scene, a suspect's known residence, or a stash location — is flagged automatically, identifying problem locations and recurring criminal activity patterns.
A vehicle registered to or associated with a suspect is linked across all cases where it appears — connecting getaway cars, surveillance vehicles, and registered vehicles to the broader suspect profile.
A firearm or weapon linked to one case is checked against all other cases — connecting crimes committed with the same weapon and building the evidentiary chain for prosecution or ATF trace requests.
A victim appearing in prior cases — as a victim, witness, or associate — is surfaced automatically, helping investigators identify repeat victimization patterns, domestic violence cycles, and witness intimidation risks.
Cases with similar geographic footprints, crime types, or modus operandi are connected automatically — helping investigators identify serial offenders, crime series, and coordinated criminal activity across separate case numbers.
The Crime Investigation template covers the full investigative lifecycle. These add-ons bolt onto specific stages when your team needs a dedicated sub-workflow for specialized activity.
A public or internal reporting portal that lets citizens, Crime Stoppers, or internal units submit crime reports directly into Hubstream — automatically creating a case record and routing it for triage.
A specialized intelligence layer for investigations involving criminal organizations and street gangs — mapping membership, territory, hierarchy, and cross-case criminal activity into a persistent intelligence picture.
Request a demo and we'll walk you through how this workflow and data model work inside a real Hubstream environment — configured for your agency's case types, units, and investigative process.