Evidence Handling, Chain of Custody, and Reporting
Evidence handling questions test whether you can preserve integrity from collection to courtroom. The exam focuses on chain of custody, documentation, packaging, digital evidence, and report writing.
Chain of custody
- Document each item at collection: description, location, date, time, collector, and condition.
- Package separately, label, seal, and log every transfer, opening, and return.
- Store securely and limit access. A gap in the log invites challenges to authenticity.
- For digital evidence, preserve the original, work from a copy, record hash values where appropriate, and document device handling.
Reporting
- Write factual, chronological reports: who, what, when, where, how, and sources.
- Distinguish observation from opinion and state limitations.
- Include photographs, logs, and attachments by identifier.
- Retain records according to law and engagement terms.
Worked example
During a workplace investigation, an investigator finds a phone in a desk. The investigator should not search it. Photograph the phone in place, note the location and time, place it in an evidence bag, seal and label it, log custody, and turn it over to the authorized custodian. If the client later asks for texts, the investigator should seek lawful authority or consent rather than bypass the chain. Reasoning: possession and search authority are separate from collection.
Traps
- Commingling items from different scenes in one bag.
- Signing a custody log for someone else.
- Editing original photos or metadata.
- Writing conclusions such as “the subject is guilty.”