Review

The article provides a comprehensive analysis of the detection and documentation of espionage at enterprises of Ukraine’s defence-industrial complex (DIC) as a continuous process in which the initial identification of indicators of an encroachment must be immediately projected onto the procedural perspective of the information obtained. The aim is to substantiate an evidence-ori-ented model of operational search and operational-search documentation, taking into account the predominance of digital traces, the security-regime sensitivity of the DIC environment, and height-ened standards of judicial scrutiny of admissibility. The methodological basis comprises normative and formal-logical approaches, forensic modelling of the modus operandi (preparation–execution–concealment), as well as a risk-oriented analysis of «nodes» of evidence loss within digital and mixed evidentiary sets. It is shown that the effectiveness of counteraction is determined not so much by the volume of information obtained as by its reproducibility, traceable provenance, capacity for independent ver-ification, and integration into an adversarial procedure. A refinement of the conceptual framework (factual data, operational-search information, materials of operational-search activity (OSA), OSA documents) is proposed, and typical procedural defects in their conflation are identified, which gener-ate gaps in reconstructing data provenance and increase the risks of inadmissibility. Scientific novelty lies in substantiating an operational matrix for the transition from factual data to procedural sources of evidence and in proposing an «evidence passport» as a standardized instrument for documenting the trajectory of an evidentiary object, key environmental parameters, access logging, and integrity assurance procedures. It is proven that in espionage cases within the DIC, judicial control performs not only a safeguard function but also an evidence-forming one: it must verify the proportionality of interferences, the boundaries of access to digital contours, the correctness of procedural integration of OSA and covert investigative (search) actions (CISA) results, and the reproducibility of procedures. The practical significance of the findings consists in formulating recommendations aimed at minimizing procedural losses in court under martial law, when the risks of infrastructure degradation, abnormal access re-gimes, and rapid loss of digital artefacts increase.