Investigative Services cheat sheet

Case lifecycle phases: intake and triage, preliminary inquiry, formal investigation plan, evidence gathering, analysis, resolution, and closure review.

A written investigative plan states the allegation, elements to prove, known facts, information gaps, resources, timeline, and review checkpoints.

The elements-of-proof matrix maps each legal element of the suspected offense to the specific evidence expected to establish it.

Solvability factors include named suspect, witness availability, identifiable property, physical evidence, and pattern linkage.

Case prioritization tiers weigh offense severity, ongoing harm risk, victim vulnerability, and evidentiary perishability.

Periodic case review intervals are set by policy or supervisory directive; each review records status, next steps, and assigned owner.

Leads are tracked in a lead log with source, date received, assignment, disposition, and verification status to prevent duplication.

Case closure requires documented disposition (cleared, unfounded, suspended, referred) plus supervisor approval and retention coding.

Reasonable suspicion supports limited investigative detention; probable cause is required for arrest and most searches under warrant.

The exclusionary rule bars use at trial of evidence obtained through unconstitutional search or seizure, subject to exceptions.

Recognized warrant exceptions include consent, plain view, exigent circumstances, search incident to arrest, and inventory searches.

Chain-of-custody breaks invite challenges to authenticity and can render physical evidence inadmissible.

Statutes of limitation set the maximum filing interval from offense date; some fraud and child-abuse offenses carry tolling rules.

Entrapment requires government inducement plus absence of predisposition; mere opportunity provision is not inducement.

Privileged communications (attorney-client, physician, clergy, spousal) may be shielded from compelled disclosure by statute.

Privacy and data-protection laws restrict collection, retention, and cross-border transfer of personal data during investigations.

Cognitive interview sequence: reinstate context, report everything, change perspective, reverse order - used to enhance witness recall.

Free recall precedes focused questioning; open prompts first, then specific probes, to limit contamination of memory.

A Miranda-type warning is required before custodial interrogation; non-custodial interviews generally do not trigger it.

Voluntariness is judged by totality of circumstances, including duration, coercion, promises, threats, and suspect characteristics.

Statement analysis compares spontaneous narrative against later accounts; inconsistencies are documented, not treated as proof of deception.

Behavioral cues alone are weak indicators of deception; corroboration through independent evidence is the reliable test.

Interview notes should record time, place, participants, questions, verbatim key answers, and any breaks or interruptions.

Recording interviews preserves accuracy, protects against later claims of coercion, and supports impeachment of changed testimony.

Chain-of-custody record fields: item description, unique identifier, collector, date/time, location, transferor, recipient, purpose.

Each transfer is logged at the moment of handoff; gaps, unexplained delays, or missing signatures weaken admissibility.

Packaging rules: paper for biological and damp items to prevent mold; sealed impermeable containers for arson debris and volatiles.

Digital evidence requires hash values (e.g., SHA-256) at acquisition and verification at each access to demonstrate integrity.

Photograph the scene before collection; include scale, orientation, and a scene log mapping item numbers to locations.

Latent prints are developed with powders, ninhydrin, cyanoacrylate, or alternate light; sequence techniques from least to most destructive.

Biological samples require gloves, sterile tools, air-drying, and refrigeration or freezing per laboratory submission guidance.

Evidence retention schedules are set by statute or policy; destruction requires authorization and documented disposal records.

Surveillance types: static (fixed post), mobile (foot or vehicle), and electronic (audio, video, GPS, network).

Mobile surveillance discipline: maintain cover for cause, avoid predictable positioning, and rotate vehicles and personnel.

A surveillance log records time, location, subject action, weather, and observer identity for each observation entry.

Covert operations require documented authorization, defined objectives, risk assessment, and a designated case officer.

Undercover identity management includes cover legend consistency, communication protocols, and extraction criteria.

GPS tracking and electronic monitoring are governed by statute and case law; scope and duration limits vary by jurisdiction.

Operational security includes need-to-know distribution, encrypted communications, and compartmentalized documentation.

Entrapment exposure rises when operatives supply means, pressure, or inducement beyond mere opportunity.

DNA profiling uses short tandem repeats; interpretation requires statistical weighting by population frequency databases.

Fingerprint comparison follows ACE-V: analysis, comparison, evaluation, verification by a second qualified examiner.

Firearms identification compares class characteristics (rifling twist, caliber) and individual marks (breech face, firing pin).

Toxicology results are reported as concentration with matrix (blood, urine, vitreous), collection time, and analytical method.

Digital forensics follows acquisition, preservation, examination, analysis, and reporting; write-blockers prevent alteration.

Latent print and trace evidence transfer rests on Locard's exchange principle: contact leaves a trace.

Chain-of-custody and laboratory accreditation standards govern admissibility of forensic test results.

Expert testimony is admitted where the method is reliable, the witness is qualified, and the evidence assists the trier of fact.

Fraud triangle: pressure/incentive, opportunity, and rationalization; documented presence strengthens motive analysis.

Financial statement fraud schemes include fictitious revenue, concealed liabilities, timing manipulation, and improper valuation.

Asset misappropriation schemes include skimming, larceny, check tampering, billing schemes, and expense reimbursement fraud.

Benford's law analysis flags digit-frequency anomalies; results are leads, not proof, and require substantive testing.

Funds tracing follows the money through bank records, wires, and shell entities; subpoena authority governs access.

Cyber intrusion investigation preserves volatile data (memory, logs, sessions) before powering down or imaging storage.

Indicators of compromise include unusual logins, lateral movement, exfiltration volume, and persistence mechanisms.

Financial records requests must be scoped to relevant periods and accounts to satisfy proportionality and legal limits.

Report structure: case identification, authority, summary, persons involved, chronology, evidence inventory, analysis, disposition.

Reports state facts and observations; conclusions must be supported by cited evidence, not opinion or speculation.

The report is discoverable; write every entry assuming cross-examination and public disclosure.

Testimony preparation includes reviewing case file, exhibits, and prior statements; familiarity with chain-of-custody entries is essential.

Lay opinion is limited to inferences rationally based on perception; expert opinion requires qualification and reliable method.

Ethical duties: truthfulness, impartiality, confidentiality, avoidance of conflicts of interest, and preservation of exculpatory evidence.

Brady-type disclosure obligations require production of material exculpatory evidence to the defense.

Corrections to reports must be documented transparently; altering a completed report without notation is misconduct.

Risk assessment precedes field operations: threat level, environment, subject history, and required support resources.

Tactical planning includes entry and exit routes, communication plan, medical contingency, and designated team roles.

Personal protective equipment selection follows hazard type: ballistic, chemical, biological, or environmental.

Use-of-force decisions must be objectively reasonable, necessary, and proportionate to the perceived threat.

Wellness and fatigue management reduce decision errors; extended operations require rotation and supervision.

Supervisory review, audit trails, and complaint intake are core controls against misconduct and bias.

Confidential informant handling requires documented risk assessment, corroboration of information, and periodic review.

Conflicts of interest, gifts, and secondary employment are disclosed and approved under agency policy.