NCIS Special Agent key terms

A documented, unbroken record of every person who handled, transferred, or stored an item of evidence, from collection through final disposition, used to prove the evidence was not altered or contaminated.

The assurance that physical or digital evidence remains unaltered and trustworthy from seizure to trial. It depends on proper packaging, secure storage, documented transfers, and hashing where applicable.

A rule generally requiring the original writing, recording, or photograph to prove its content, unless a recognized exception applies. It applies to what a document says, not to events merely witnessed.

The process of proving that an item of evidence is what its proponent claims it to be, often through witness testimony, distinctive characteristics, or comparison with known samples.

A fixed-length digital fingerprint computed from a file or device image. Matching hashes before and after handling demonstrate that digital evidence has not changed.

A bit-for-bit duplicate of a storage device created for examination while the original is preserved. Investigators analyze the copy and verify it against the original using hash values.

A hardware or software tool that prevents any write operation to a connected storage device, ensuring the original evidence is not modified during acquisition or examination.

Contamination of evidence or a witness's memory by outside information, suggestion, or improper handling, which can undermine reliability and lead to suppression or diminished credibility.

The constitutional protection against unreasonable searches and seizures, generally requiring a warrant supported by probable cause, subject to recognized exceptions.

A reasonable belief, based on facts and circumstances, that a crime has been, is being, or will be committed, or that evidence will be found in a particular place.

A court order authorizing officers to search a specified place and seize specified items. It must be supported by probable cause and describe the place and items with particularity.

The requirement that a warrant clearly describe the place to be searched and the persons or things to be seized, preventing general exploratory searches.

A written statement of facts sworn under oath, commonly used to establish probable cause for a warrant or to support a charging decision.

Urgent conditions, such as imminent danger to life or the likely destruction of evidence, that may justify a warrantless search or entry.

A doctrine allowing warrantless seizure of evidence when an officer is lawfully present, the incriminating nature of the item is immediately apparent, and the officer has lawful access.

The principle that evidence derived from an illegal search or seizure may be excluded, subject to exceptions such as independent source, inevitable discovery, and attenuation.

A pretrial motion asking the court to exclude evidence obtained through constitutional or statutory violations, such as an unlawful search or an improperly obtained statement.

The warnings required before custodial interrogation: the right to remain silent, that statements may be used against the person, the right to counsel, and appointment of counsel if indigent.

Questioning by law enforcement after a person has been taken into custody or otherwise deprived of freedom in a significant way, triggering Miranda protections.

A knowing, voluntary, and intelligent relinquishment of a known right, such as the right to remain silent or to have counsel present during questioning.

A structured interview and interrogation method using behavioral analysis, a non-accusatory interview, and a psychologically oriented confrontation, criticized for false-confession risk.

A non-accusatory investigative interviewing framework emphasizing Planning, Engage, Account, Closure, and Evaluation, designed to gather reliable information rather than obtain a confession.

A witness interviewing method that uses memory-retrieval strategies such as reinstating context, reporting everything, changing perspective, and reversing order to improve recall accuracy.

An admission of guilt by an innocent person, often arising from coercive questioning, lengthy interrogation, threats, promises of leniency, or the person's own vulnerability.

Pressure or threats that overcome a person's free will and can render a statement involuntary and inadmissible, including physical force, threats, or improper promises.

A witness's recognition of a suspect, obtained through lineups, photo arrays, or showups; reliability depends on estimator variables and disciplined, non-suggestive procedure.

The constitutional guarantee of fair treatment through the legal system, including notice, a hearing, and impartial procedures; violations can invalidate evidence or convictions.

The Uniform Code of Military Justice, the federal statute governing military criminal law, including offenses, courts-martial, nonjudicial punishment, and appellate review.

The UCMJ provision for nonjudicial punishment, allowing a commander to impose limited discipline for minor offenses without a court-martial, subject to the member's rights.

A military court trying UCMJ offenses. Types include summary, special, and general, with increasing jurisdiction, procedure, and severity of authorized punishments.

The scope of NCIS authority to investigate felony-level offenses involving Navy and Marine Corps personnel, property, and interests, often coordinated with other agencies.

Protecting a scene from entry, alteration, or loss by securing boundaries, logging personnel, and minimizing disturbance until documentation and collection are complete.

A scaled drawing of a scene showing the location of evidence, furniture, and reference points, used with photographs and notes to document spatial relationships accurately.

Systematic photography of a scene from overall, midrange, and close-up perspectives, often with scales, to record conditions and evidence before anything is moved.

The forensic principle that every contact leaves a trace, meaning a perpetrator both deposits and picks up material at a scene, forming the basis for trace evidence collection.

Small physical materials such as hair, fibers, glass, paint, soil, or gunshot residue transferred during a crime and used to associate people, objects, and places.

The documented sequence of laboratory examinations, instruments, and analysts applied to evidence, supporting conclusions and enabling independent review or challenge.

A written framework setting out case theory, elements to prove, leads, evidence to obtain, interviews to conduct, and timelines, updated as the investigation develops.

The organized record of an investigation, including reports, evidence logs, statements, photographs, and correspondence, maintained for review, prosecution, and disclosure.

The specific facts the government must prove beyond a reasonable doubt for a particular crime, such as act, intent, causation, and jurisdictional facts.

Preparing clear, factual, chronological narratives that record observations, actions, statements, and evidence without opinion or speculation, suitable for court and review.

A systematic tendency in reasoning or perception that distorts judgment, such as confirmation bias, which can lead investigators to favor evidence supporting an initial theory.

The tendency to seek, interpret, and remember information that supports existing beliefs while ignoring contrary evidence, a common source of investigative error.

The disciplined practice of questioning assumptions, evaluating evidence quality, considering alternatives, and testing conclusions against facts rather than intuition.

The ability to assess a workplace dilemma, weigh competing obligations, and choose a response that is lawful, ethical, and consistent with organizational values.

A reasoned process for resolving dilemmas by identifying stakeholders, applicable rules, and consequences, then selecting the most defensible course of action.

Consistently acting honestly, impartially, and accountably, including reporting misconduct, avoiding conflicts of interest, and refusing gifts or favors that could compromise judgment.

The prosecution's constitutional duty to disclose material exculpatory evidence to the defense, including impeachment information that could affect a witness's credibility.

Criminal activity conducted through or targeting computers and networks, including unauthorized access, fraud, identity theft, and distribution of illegal material.

Information stored or transmitted in digital form, such as files, logs, messages, and metadata, that is collected and preserved under strict chain-of-custody controls.

Digital information lost when a device loses power, such as running processes, network connections, and memory contents, which must be captured first at a scene.

Data describing other data, such as file creation times, authorship, geolocation, and device identifiers, useful for establishing timelines and linking activity to a person.