Evidence Collection, Handling, and Chain of Custody
Principles of evidence integrity
Evidence must be relevant, authentic, complete, and unaltered. Candidates should understand the concepts of relevance, reliability, and continuity. Chain of custody is the documented record of who handled evidence, when, where, and why. It protects against tampering, loss, and challenges to authenticity.
Collection and handling
Know the basics of securing a scene, minimizing contamination, labeling, packaging, and recording. Digital evidence requires particular care: preserve original media, use write-blocking where appropriate, hash values to demonstrate integrity, and documented imaging procedures. Understand that contemporaneous notes are themselves potential evidence.
Traps in questions
Common traps include assuming a gap in custody automatically destroys evidence value (it affects weight, not necessarily admissibility), confusing storage location with custody documentation, and failing to record transfers. Another trap is treating a photograph as a substitute for the original item rather than as a record of it.
Rule of thumb
Use the "one item, one record, one identifier" rule: each item gets a unique identifier and a continuous record from seizure to disposition, with every transfer signed and timed.
Worked example
A laptop is seized. It is photographed in place, powered down appropriately, labeled with a unique number, logged into the evidence register, and transferred to a secure store with signatures. A forensic image is later made, and the hash is recorded and verified. Every step is documented.