AFOSI Special Agent study plan

Map the evidence lifecycle from scene/consent search through seizure, chain-of-custody documentation, storage, and release, and write a one-page flow diagram from memory

Distinguish legal standards of proof (reasonable suspicion, probable cause, preponderance) and match each to the investigative action it authorizes

Compare search-authority tools (warrant, consent, exigency, incident to arrest, plain view) and list two failure modes for each

Practice drafting a chain-of-custody entry and an evidence-receipt log with no gaps in time, person, or location

Apply Fourth Amendment search-and-seizure rules to three fact patterns and justify each conclusion in writing

Explain the exclusionary rule, its exceptions, and how tainted evidence can be purged

Outline the elements of the most-tested federal offenses (theft of government property, false statements, bribery, wire fraud) and identify what evidence proves each element

Draft a probable-cause affidavit skeleton for a hypothetical search with facts, inferences, and a specific request for items to be seized

Define counterintelligence, insider threat, and espionage-related collection and distinguish them from criminal fraud investigations

Identify the agencies and reporting channels in the national-security pipeline (FBI, NCIS, DIA, NSA, DoD CI components) and what each owns

Explain how classified information handling, security clearances, and need-to-know affect interview and evidence decisions

Build a decision tree for when a case should be treated as a national-security matter versus a criminal one

Walk through a procurement-integrity fact pattern: identify the contracting phase, the vulnerability, and the fraud indicator

List the elements of bribery, gratuity, conflict-of-interest, and false-claim offenses and match each to the evidence that proves it

Explain how source operations and CI interviews differ from criminal interviews and when each is appropriate

Practice spotting red flags in contract documents (bid rotation, split purchases, unusual modifications) from a self-built checklist

Trace the money in a fraud scenario: identify the accounts, transfers, and records that establish intent and loss amount

Explain the basics of digital evidence acquisition (imaging, hashing, write-blocking) and why integrity matters in court

Describe common technology-enabled crimes (business email compromise, account takeover, ransomware) and the first investigative steps for each

Draft preservation and records-request language appropriate for a financial or communications provider

Distinguish interview from interrogation and identify when Miranda and voluntariness rules apply

Build a questioning plan that moves from non-accusatory fact-finding to confrontation, with a written outline of themes and transitions

Practice recognizing and resisting coercion, false-confession risk, and improper promises

Explain source recruitment, handling, and documentation basics and how a source's credibility is tested

Write a case report in the standard structure: synopsis, facts, evidence, investigative steps, and recommendations, in plain and precise language

Identify the AFOSI mission, its relationship to the Air Force and DoD, and the reporting lines that affect a case

Explain the professional-standards rules on candor, conflicts of interest, and handling of sensitive information, and apply them to two ethical dilemmas

Edit a sample report to remove speculation, hearsay, and unsupported conclusions

Run a timed mixed-domain practice set and log every wrong answer by domain and error type

Re-review the three weakest domains using the error log, not by rereading everything

Rehearse the highest-yield facts: elements of offenses, standards of proof, evidence-handling rules, and reporting channels

Build a one-page final cheat sheet in your own words that you could recreate from memory