Investigative Techniques and Evidence Handling
Method and Chain of Custody
Sound investigation follows a plan: define the objective, gather lawful background, conduct interviews and surveillance, then document. A candidate must understand chain of custody - every transfer of physical evidence logged with date, time, handler, and purpose - and why breaks in the chain undermine admissibility and credibility. Know the difference between physical evidence, documentary evidence, testimonial evidence, and digital evidence, and the preservation rules for each. Digital evidence requires hash verification, write-blocking, and metadata preservation.
Interviews and Surveillance
Understand interview structure: preparation, rapport, open-ended questions, note-taking, and avoiding leading or coercive tactics. Know that statements should be documented contemporaneously and reviewed by the witness. For surveillance, know documentation requirements (time-stamped logs, photographs with context), legal boundaries (no trespass, no stalking), and the difference between stationary and mobile surveillance.
Traps
Questions often present a scenario where evidence was handled informally - a witness hands over a phone and the investigator scrolls through it. That is both a chain-of-custody failure and a privacy problem. Another trap: treating an unrecorded interview as worthless (it is not, but it is weaker) or treating a recorded one as automatically admissible.
Rule of Thumb
If you did not document it, assume you cannot prove it. Every item of evidence should be traceable from collection to courtroom.
Worked Example
A client provides a USB drive allegedly containing emails. The investigator should not open it on a personal machine; instead, log receipt, create a forensic image with a hash, work from the copy, and record every access.