Evidence Handling and Documentation
Continuity is the point
Evidence is only as good as the record showing who had it and what happened to it. Candidates must understand chain of custody: a contemporaneous, signed log recording each transfer, the date and time, the purpose, and the condition of the item. Physical items should be packaged, labelled, sealed, and stored securely; digital items should be hashed or at minimum copied with metadata preserved and the original left untouched where practicable.
Notes and reports
Field notes are made at the time or as soon as practicable, in ink, with errors struck through and initialled rather than obliterated. Reports should separate observation from inference: write what was seen and heard, then, if required, opinion clearly labelled as such. Identify persons by full name and role, use consistent date/time formats including the time zone, and avoid speculation and hearsay presented as fact. Photographs and video need a log of when, where, by whom, and what they depict.
Retention and disclosure
Know that files may be producible in litigation or to the regulator, and that retention and destruction must follow the client agreement, privacy law, and any litigation hold. Never alter or destroy material once a dispute is reasonably anticipated.
Traps
Questions test the difference between fact and opinion, the danger of rewriting notes after the fact, and the assumption that a digital copy is automatically authentic. Another trap: failing to record a gap in continuity and hoping no one notices.
Worked example
A phone is found at a scene. Rule of thumb: photograph it in place, log the seizure, bag and seal it, and record every handover - then explain any gap in the log openly rather than conceal it.