Investigative Techniques and Evidence Handling
This domain tests practical methodology plus the discipline of preserving evidence so it survives legal scrutiny. Understand the investigative cycle: define the objective, plan lawfully, gather information, corroborate, document, and report. Know the main techniques - interviews and statements, surveillance (mobile and stationary), background and public-records research, scene documentation, and chain-of-custody handling of physical and digital evidence. Traps: questions reward corroboration and documentation over dramatic single-source conclusions; they penalize investigators who rely on hearsay or fail to record times, locations, and conditions. Another trap is confusing what an investigator may lawfully do (observe from public places, photograph what is plainly visible) with prohibited conduct (trespass, illegal entry, interception of communications).
Evidence handling: maintain an unbroken chain of custody, label and log each item, store securely, and avoid contaminating or altering original digital media - work from copies and preserve originals. Reports should be factual, objective, and free of conclusions the investigator cannot support.
Rule of thumb: "If it isn't documented, it didn't happen." Every observation should be tied to date, time, place, and method. Worked example: during surveillance you observe the subject leave a residence and drive to a store. A defensible report records the address, times of departure and arrival, vehicle description and plate, weather/visibility, and that the observation was made from a public vantage point - not just "I saw them go shopping." Similarly, for a recovered document, log who found it, when, where, and every transfer thereafter. When a technique's legality is uncertain, the safer exam answer is the one that stays within public observation and lawful records access.