→
Why it matters
Correct evidence handling requires the right workflow. The key is that the integrity of effects and data can be demonstrated throughout the process — so if it reaches court, there is no doubt about what was done.
Doubt is always raised in a lawsuit — that is the defence's main job. The more thorough you have been, the less the prosecutor's case can be doubted.
→
Data collection & securing workflow
When collecting effects for examination: document, document, document.
- Time and location.
- Who was present (in personnel matters, that HR was present too).
- How many effects were collected; what data, and how.
- How data was secured — with or without write protection, and why.
- Who is responsible for the effects until stored in the forensic room or safe.
- A list of hand-overs between colleagues — this is the heart of CoC.
→
When evidence changes hands
Each hand-over carries a signature and a description of the effects involved — it can be largely automated with a form.
→
During transport
For important cases, effects must be transported so their physical integrity can be demonstrated — proving nothing was tampered with. Tamper-evident bags can be bought (e.g. Miladan, Scenesafe).