Documentation and Chain of Custody
What this domain tests
This domain covers contemporaneous notes, scene and photo logs, evidence packaging records, and chain-of-custody entries that make evidence admissible and defensible.
Core rules and concepts
- Record facts as they happen: date, time, location, personnel, observations, and actions; correct errors with a single line, initials, and date, not erasure.
- Chain of custody is a chronological record of every transfer: from, to, date, time, purpose, and signature.
- Each item gets a unique identifier and description; seals are tamper-evident and initialed across the seal.
- Photo logs link image numbers to subject, scale, and location; evidence logs link item numbers to collection location.
- Store evidence in a secure, access-controlled area and document every opening of a sealed package.
Worked example
A cartridge case is found on a kitchen floor. The technician photographs it in place, assigns item 03, packages it in a pillbox, seals and initials the seal, and records collection at 14:22. At the lab, the analyst signs the chain and notes the seal was intact. Reasoning: the intact seal and complete transfer record rebut a claim of tampering.
Traps
Signing for another person; back-dating entries; using a single bag for multiple items; failing to note a broken seal; not recording time out of storage; destroying original notes after typing a report.