Security Track: Patrol, Access Control, Evidence and Emergency Response · Module 3 of 4 · about 15 min
Evidence and chain of custody
If an incident might go to court or a disciplinary hearing, how you handle evidence matters as much as what you find. Protect the scene, keep people out, and do not touch or move things you do not need to.
Chain of custody is the written record of who had each item, when and why, from collection to court. Every handoff gets signed and dated. A gap in the chain gives the other side a reason to question the evidence.
Digital evidence is now the most common kind: camera footage, badge logs, phone photos and computer data. NIST Special Publication 800-86 lays out a process for collection, examination, analysis and reporting. Investigators make copies and verify them with cryptographic hashes, a fingerprint value that changes if even one bit changes, and do their work on the copy, not the original.
Write down how you collected things and why. Photograph before you move anything. When in doubt, preserve and call people trained to handle it.
Sources
- NIST SP 800-86: Guide to integrating forensic techniques into incident response
- BLS: Forensic science technicians
Module quiz
5 questions, 4 correct to pass. You'll see what you missed and why, and you can retake it.