Evidence Handling, Documentation and Case File Management
This domain tests whether evidence can survive challenge: whether it is authentic, complete, lawfully obtained and continuously accounted for. Documentation is not paperwork after the event; it is the record that proves the officer acted within authority and that the exhibit is the same item produced in court.
Core rules
- Seizure record (محضر الضبط) immediately: describe each item, quantity, condition, serial number, place, date and time, persons present and signatures; note any refusal to sign.
- Give each exhibit a unique number. Seal it, log storage, and record every transfer with signature and time. No unrecorded access.
- Digital evidence: preserve the original, make a forensic copy, record a hash, and do not browse beyond the lawful authority or warrant scope; isolate devices where appropriate.
- Samples: split, seal and label them, maintain laboratory chain of custody, and obtain an expert report where needed.
- Case file: use an index, keep documents in chronological order, distinguish originals from copies, protect confidentiality, apply retention rules, and disclose relevant material to the prosecution. Corrections must be initialled and dated, not erased.
- Contemporaneous notes carry more weight than later reconstruction.
Worked example
An officer seizes a phone and reads messages in the shop, then logs the phone two days later. The gap and unauthorised access break continuity and may breach privacy. The correct approach is to seize under the legal power, record the device state, seal it, obtain the required authorisation for content, make a forensic copy, hash it, and log every transfer. Reasoning: evidence must be shown to be what it purports to be and not altered.
Traps
- Unsigned inventories and missing witness details.
- Storing exhibits in a desk drawer without a log.
- Backdating notes or rewriting them after review.
- Failing to disclose a broken seal or an unexplained access gap.