Evidence Handling, Records, and Reporting
This domain tests whether you can preserve, document, and present information so that a client, attorney, arbitrator, or court can rely on it. It covers chain of custody, digital evidence, report writing, retention, confidentiality, and testimony.
Core rules
- Chain of custody: label each item with case number, description, collector, date, time, and location; record every transfer and storage location. Seal physical evidence, photograph it before moving it, wear gloves, and minimize handling. Use a locked storage area, not a vehicle or home desk.
- Digital evidence: preserve originals and work from copies, recording hash values where practicable. Capture metadata and the source URL or device; note time-zone settings and clock accuracy. For video, preserve the full clip and a viewing log, not just selected frames.
- Reports: write in the first person, chronologically, with dates, times, locations, people, and sources. Separate observation from inference ("I saw" versus "it appeared"). Include negative findings and limitations. Correct errors by numbered addendum, never by overwriting the original.
- Retention and release: follow the Act, board rules, the client contract, and any litigation hold. Store files securely and release them only to authorized persons or under legal process. Do not assume a PI's files are privileged; only attorney-directed work may be protected.
- Testimony: bring the file and chain-of-custody records; answer only what is asked; do not guess.
Worked example
An investigator finds a discarded phone in a parking lot. She photographs it in place, notes the time and location, wears gloves, places it in an evidence bag, logs it, and stores it. She does not open it or search its contents without consent or legal authority. She notifies the client and, if appropriate, law enforcement, and records each transfer. At hearing, she can authenticate the phone and explain every hand it passed through.
Traps
Rewriting a "clean" report after the fact; stating a conclusion as an observation; breaking the chain by leaving evidence unlogged; deleting files at case closing; promising confidentiality the law does not provide.