Investigative Services flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Elements-of-proof matrix

A planning tool that lists each legal element of the suspected offense and identifies the specific evidence expected to establish that element at trial.

Solvability factors

Case attributes such as a named suspect, available witnesses, identifiable property, or physical evidence that predict whether further investigative effort is likely to succeed.

Lead log

A register recording each investigative lead with its source, date received, assigned investigator, verification status, and disposition so that duplicate or unassigned work is prevented.

Case closure review

Supervisory approval of a documented disposition such as cleared, unfounded, suspended, or referred, together with retention coding and final case file assembly.

Reasonable suspicion

A specific, articulable basis supported by facts that a person has committed or is about to commit an offense; it permits limited investigative detention but not arrest.

Probable cause

Facts and circumstances that would lead a reasonable person to believe an offense has occurred and that a particular person or place is connected to it.

Exclusionary rule

The doctrine barring use at trial of evidence obtained through unconstitutional searches or seizures, subject to recognized exceptions such as independent source and inevitable discovery.

Statute of limitations

A statutory deadline setting the maximum interval after an offense within which charges may be filed, subject to tolling rules for certain offense types.

Cognitive interview

A structured witness technique that reinstates mental context, requests full recall without interruption, changes perspective, and reverses narrative order to enhance memory retrieval.

Custodial interrogation

Questioning by authorities after a person has been taken into custody or otherwise deprived of freedom in a significant way, triggering required warnings in many jurisdictions.

Voluntariness of statement

The totality-of-circumstances test weighing duration, promises, threats, coercion, and suspect characteristics to determine whether a statement was freely given.

Interview documentation

Contemporaneous notes or recordings capturing time, place, participants, questions asked, key verbatim answers, breaks, and any interruptions during the session.

Chain of custody

A chronological record documenting each custodian, transfer, date, time, purpose, and storage location of an evidence item from seizure through final disposition.

Biological evidence packaging

Damp or biological items are air-dried and placed in breathable paper packaging, while volatiles and arson debris go into sealed impermeable containers.

Hash verification

Computing a cryptographic digest such as SHA-256 at acquisition and again at each access to demonstrate that digital evidence has not been altered.

ACE-V fingerprint method

A four-stage latent print comparison process comprising analysis, comparison, evaluation, and verification by a second qualified examiner before a conclusion is reported.

Locard's exchange principle

The forensic premise that contact between persons or objects results in transfer of trace material, allowing physical evidence to link a suspect to a scene.

Write blocker

A hardware or software tool that permits read-only access to storage media during forensic imaging so that original data is not modified.

Mobile surveillance discipline

Techniques that avoid detection, including maintaining cover for cause, varying positioning, and rotating vehicles and personnel to prevent predictable patterns.

Surveillance log

A contemporaneous record of each observation listing time, location, subject actions, environmental conditions, and the identity of the observing operative.

Covert operation authorization

Documented approval defining objectives, risks, cover identity, communication protocols, extraction criteria, and a designated case officer before an operation begins.

GPS tracking authority

Statutory and case-law limits governing electronic monitoring of vehicles or persons, including warrant requirements, scope, and permissible duration.

Fraud triangle

A model describing fraud as arising from perceived pressure or incentive, opportunity, and rationalization, each of which investigators document as motive evidence.

Benford's law analysis

A digit-frequency test that flags anomalous distributions in financial datasets; results are investigative leads requiring substantive verification rather than proof of fraud.

Volatile data preservation

Capturing memory, active sessions, and logs before shutdown or imaging, because these artifacts are lost when a system is powered off.

Indicators of compromise

Observable artifacts such as anomalous logins, lateral movement, persistence mechanisms, or unusual exfiltration volume suggesting a system has been breached.

Report structure

A standard format including case identification, authority, summary, persons involved, chronology, evidence inventory, analysis, and disposition for each investigation.

Brady disclosure

The obligation to produce material exculpatory or impeaching evidence to the defense, supporting the duty of impartial rather than adversarial investigation.

Lay versus expert opinion

Lay opinion is limited to inferences rationally based on perception, while expert opinion requires qualified status, reliable method, and assistance to the trier of fact.

Operational risk assessment

Pre-operation evaluation of threat level, environment, subject history, and required support resources that determines staffing, equipment, and contingency planning.

Objectively reasonable force

A standard requiring that force be necessary and proportionate to the perceived threat, judged from the perspective of a reasonable officer on the scene.

Informant handling controls

Documented risk assessment, corroboration of informant information, periodic supervisory review, and disclosure of any conflicts or consideration given.