Evidence Collection
Evidence Collection
Evidence collection is where investigations succeed or fail. Candidates must understand the categories of evidence-testimonial, documentary, physical, and digital-and the standards that make each admissible and credible: relevance, authenticity, completeness, and lawful acquisition.
Core concepts include chain of custody (an unbroken, documented record of who handled evidence, when, and why), proper packaging and labeling, contemporaneous note-taking, photography with scale and context, and the handling of digital evidence through forensic imaging rather than direct examination of originals. Understand the difference between original evidence and copies, and why hash values matter for digital integrity. Know the roles of consent, subpoena, and warrant in lawful acquisition, and the principle of least intrusion-collect only what is relevant and authorized.
Exam traps are predictable. One is the belief that chain of custody only matters at trial; in fact it begins at the moment of seizure. Another is examining a device or original document directly, which alters metadata or risks contamination. A third is collecting everything as a hedge-over-collection creates privacy, retention, and privilege problems. Watch for questions that reward speed over documentation; the disciplined answer almost always wins.
Rule of thumb: if you cannot state who had the item, where it was, and what happened to it at every moment, the chain is broken.
Worked example: An investigator receives a USB drive from a witness. The correct sequence is to document receipt, label and seal it, log it into the evidence system, and image it forensically before analysis-never to plug the original into an analyst workstation.