Investigative Techniques and Evidence Handling
Domain focus
This domain tests whether an investigation is lawful, repeatable, and admissible. The exam favors methodical planning, documented custody, and notes that separate observation from inference.
Plan and scope
Define the question, the legal authority, and the limits before acting. Identify whether entry is consensual, whether a location is public, and whether any record request has a permissible purpose. For interviews, decide whether the person is a witness, subject, or complainant and whether counsel is involved. Record date, time, location, people present, and consent.
Interviews and statements
Ask open questions, let the subject talk, and record verbatim quotes where possible. Do not promise leniency, threaten, or impersonate authority. If a statement is written, have the person initial corrections and sign; note whether it was read back.
Physical and digital evidence
Photograph the scene before moving anything, include scale and context, and log each item. Preserve originals: do not crop, edit, or overwrite the only copy. For digital files, record the source device, collection method, time, and a hash value; store in a controlled location. Maintain a chain-of-custody form with every transfer-who, when, where, and why.
Worked example
A PI photographs fresh tire marks in a client's driveway. She shoots RAW plus JPEG, notes the camera, time, and direction, then copies files to a case folder and computes a SHA-256 hash. The original card is sealed. In the report she writes "two parallel tire impressions, approximately 8 inches wide" rather than "a getaway vehicle." Reasoning: the first is observable and reproducible; the second is an inference the client may argue.
Traps
Editing the only photo; gaps in custody; mixing notes and conclusions; recording a conversation without confirming consent; failing to document where an item was found.