Evidence Handling, Chain of Custody, and Rules of Evidence
Foundations
Evidence must be relevant, authentic, and not excluded by a rule such as hearsay. Authentication means showing the item is what the proponent says it is. The best-evidence rule generally requires the original writing, recording, or photograph to prove its contents, with exceptions. Hearsay is an out-of-court statement offered for its truth; common exceptions include excited utterance, present sense impression, business records, statements against interest, and admissions. New York's business-records foundation is CPLR 4518.
Chain of custody
Document every handoff: who collected, when, where, from whom, in what condition, and to whom. Use a unique evidence number, seal and initial containers, log transfers, and store in a secure location. Minimize handling. For digital evidence, photograph the device, do not browse it, preserve passwords lawfully, and create a forensic image with a hash value. Keep original notes; do not rewrite them.
Reports and discovery
Write facts, not conclusions. Record negative results too. Preserve metadata and original files. In criminal matters, suppression motions under CPL 710 can turn on how evidence was obtained; in civil matters, discovery can reach your file.
Worked example
A PI finds a USB drive in a client's office. Correct handling: photograph it in place, note the location and time, place it in an antistatic bag, seal and initial the bag, log it, and have a forensic examiner image it. Plugging it into a personal laptop can alter timestamps and expose the PI to malware or claims of tampering.
Traps
Gaps in the log; screenshots without metadata; paraphrasing a witness instead of quoting; and assuming hearsay is always inadmissible.