Evidence management.
Evidence management is everyone's responsibility.
The proper handling, chain of custody,
procedural, all that, everybody's responsible for.
It's one of the I OCE principles.
We alluded to that in our ACPO principles and our sweetie principles.
But everybody is responsible for the
safeguarding and safe handling of evidence whilst in their possession.
Evidence management helps to protect the true state of the evidence.
It's achieved by proper handling and documentation of the evidence.
At the time of evidence transfer, both the sender and receiver need to provide
information about the date and time of transfer in the chain of custody records.
Again, we've talked about that.
We're going to see an example of one here shortly.
The procedures used to protect the
evidence and document it while collecting are a logbook of the project evidence
tags to uniquely identify the evidence in a chain of custody record.
Chain of custody.
We've talked about it quite a bit.
It's really important.
Finally, we got a slide dedicated to the definition of chain of custody.
Chain of custody is a legal document.
It demonstrates the progression of
evidence as it travels from the original evidence location to forensic laboratory.
Every time it changes hands, it's signed away and signed into receipt.
It administers the collection, handling,
the storage, testing, and disposition of the evidence.
Documentation should list all the people involved in the collection and
preservation, their actions with the stamp for each activity.
It may also include additional case data. Not always.
Sometimes the chain of custody is just the transfer.
Sometimes it's part of an evidence worksheet.
The case number, name and title of the person from whom the evidence was
received, address and telephone number, location, which the evidence was obtained,
date and time of evidence, and item number, quantity or description of items.
Now, we do have exhibit numbering, which a lot of times is the initials of whoever
gathered it, date and time, and then exhibit and component, subcomponent of.
But that exhibit numbering can vary from agency to agency.
A simple format of the chain of custody document, again, received from
location from which evidence was obtained, case number, address, telephone number,
reason was obtained, date and time was obtained, item number, quantity,
description of item, and then the signed, released buys and received buys.
That is huge.
That is the most salient aspect of a chain of custody form.
This needs to account for every transfer of possession along the lines.
Otherwise, it draws into question the integrity of the evidence.
It was not documented as in receipt or possession at
this time, and that means any lapse in chain of custody means the evidence could
have been tampered with and that generally results in it being suppressed.
The evidence bag contents list should
include the date and time of the seizure, the investigator who sees the evidence,
the exhibit number, site from which the evidence was seized, details of the
contents of the evidence bag and the submitting agency and its address.
Packaging, transporting, and storing.
I would think that most of this goes
without saying, however, you need to list out specifics of how to handle evidence.
This is actually going to go into your procedural documents.
Considerations, concerns, damage and transport is always a possibility.
Want to take appropriate precautions to ensure that that doesn't happen.
Investigators must package, store and transport all physical evidence for
further analysis after collecting all volatile information.
More specifically, they must pack all
available physical evidence, equipment and components, label and list everything.
Avoid turning the computer upside down or
putting it on its side during transportation.
Sometimes hard drives aren't screwed in properly, turning it on its
side, could slide out, could slam into some pins on a mother board, that thing.
Keep the evidence away from magnetic
sources such as radio transmitters, speaker magnets, heated seats.
Store it a safe area away from extreme heat, cold, or moisture.
Avoid storing it in vehicles for a long period of time.
Maintain proper chain of custody of the transported evidence.
Take special precautions while storing wireless and portable devices.
That would be specifically constraining the physical signal.
We have what are called stronghold bags or stronghold boxes or fair day cages, which
should be used to encapsulate or constrain the signal on portable devices.
That way, they're not remoted into and remotely wiped.
Talked about that in our mobile device security.
Ensure these devices do not connect to the networks by storing them in signal
blocking containers, and there it is again.