Evidence Handling, Chain of Custody, and Documentation
What the exam tests
This domain tests whether you can preserve evidence so it is admissible and credible. Expect questions on chain of custody, packaging, labeling, photography, digital evidence, and contemporaneous notes.
Core rules
- Chain of custody: Every transfer of evidence must be documented with date, time, location, person receiving it, and purpose. Gaps or unexplained transfers invite tampering arguments.
- Packaging and labeling: Photograph the item in place before moving it. Wear gloves where appropriate, use clean containers, seal with tamper-evident tape, and label with a unique case number, date, time, collector, and description.
- Storage: Keep evidence in a secure, access-limited location. Do not store evidence in a vehicle or unsecured desk. Maintain a log for every access.
- Digital evidence: Do not plug unknown devices into your own computer. Preserve the original, document hash values when making forensic copies, and record who handled the device. Digital photographs and video should retain metadata when possible.
- Documentation: Notes should be contemporaneous, factual, and non-conclusory. Record negatives-what you did not observe-as well as positives. Authentication under Pa.R.E. 901 and business-records foundations under Pa.R.E. 803(6) depend on reliable documentation.
Worked example
An investigator finds a USB drive in a parking lot during a surveillance assignment. The investigator photographs the drive where it lies, notes the time and location, picks it up with gloves, places it in an antistatic bag, seals and labels it, and logs the seizure. The investigator does not open the drive on a personal laptop. If examination is needed, a forensic copy is made with a hash value, and the original remains sealed. Each transfer to the client or police is logged.
Traps that cost marks
- Breaking the chain by handing evidence to an undocumented person.
- Commingling items from different scenes in one bag.
- Altering or “cleaning up” original digital files.
- Writing conclusions such as “the subject was clearly guilty” in notes.