Criminal Investigation and Evidence Handling
Criminal Investigation and Evidence Handling
This domain tests how an agent protects a scene, lawfully seizes evidence, and maintains integrity from collection through disposition. Expect questions on chain of custody, search authority, packaging, and documentation.
Core rules
- Secure, isolate, and document the scene before moving items; record who entered, when, and why.
- Use the least intrusive lawful authority: warrant, military search authorization, consent, exigent circumstances, or a recognized exception such as plain view or inventory.
- Photograph before touching; sketch, measure, and log each item. Give every item a unique evidence number.
- Package separately to prevent cross-contamination: biological evidence in breathable containers after drying; digital devices in antistatic or Faraday packaging; firearms unloaded and rendered safe by qualified personnel.
- Maintain an unbroken chain of custody with date, time, person, purpose, and storage location. Transfer to a laboratory only through documented channels.
- Preserve digital evidence before analysis; do not boot a seized device or open files beyond the authorized scope.
Worked example
A dorm room is reported burglarized. A laptop, a bloodstained shirt, and a threatening note are present. The agent secures the room, photographs the shirt in place, dries and packages it in paper, photographs the laptop and note, collects the laptop in antistatic packaging, and logs each item. A military search authorization is obtained before searching the laptop's contents. Reasoning: the scene and items are preserved; biological and digital evidence need different handling; collection does not equal authority to search stored data.
Traps
Contaminating DNA evidence by improper packaging; breaking custody with undocumented transfers; assuming consent to enter a room equals consent to search every device; and treating photographs as a substitute for written measurements and notes.