Evidence, Reporting, and Case Documentation
Evidence, Reporting, and Case Documentation
This domain tests whether your file can survive a deposition: how you collect, preserve, and describe evidence; how you write reports; and how you handle corrections and retention. The exam favors contemporaneous, factual, attributable records over polished narratives written weeks later.
Core rules
- Preserve originals: do not edit, crop, or overwrite photo, video, or audio; record hash values when practical; keep native files and a working copy.
- Chain of custody: log each transfer with date, time, from and to, purpose, and signature; gaps invite challenge.
- Notes: date and time every entry, use ink or locked digital notes, strike through errors with initials, never erase.
- Reports: identify case, client, author, date, scope, sources, and methods; separate observation from inference; attach a media index.
- Correction protocol: issue a dated supplement; do not rewrite history.
Worked example
You receive a smartphone video from a witness showing a subject near a store. You copy the native file, record the file name, size, and SHA-256 hash, log receipt, and note the phone's clock offset. In the report you write: 'At 14:07 (source clock; 14:02 verified), subject entered the north door.' Reasoning: authentication depends on showing the file is unchanged and the time is explained. Editing the clip to zoom would create a derivative; keep it separate and label it.
Traps that cost marks
- Reports that state conclusions ('subject was intoxicated') without observed facts.
- Missing chain-of-custody entries or unsigned transfers.
- Mixing client instructions, investigator opinion, and evidence in one undifferentiated narrative.
- Late reports that rely on memory rather than notes.
- Deleting drafts or cleaning up originals.