Evidence management involves ensuring that the nature of the evidence is not compromised, keeping it in a manner that preserves the nature of the evidence, and handling it in a way that ensures that there is no doubt over tampering of evidence. Managing the evidence related to an event involves storing, sorting, and preserving the evidence so that it is readily available and can be called upon as and when needed to prove the circumstances of an event.
Evidence Management
The techniques used in evidence management are inventory control of items of evidence related to many events, including tagging and sorting; preserving sensitive and perishable pieces of evidence by storing them in an appropriate environment; establishing a chain of custody and handover of responsibility starting from the collection of evidence to the eventual conclusion of the investigation.
When initiating a document for future identification, fraud examiners should only do so in a noncritical area and use a different type of writing instrument than was used for the questioned writings on the document. The examiner should never write or make markings on the original document other than his unobtrusive initials for identification.
Likewise, a document should not be folded, stapled, paper clipped, crumpled, or altered in any other way that would affect or change it from its original condition. If the document is stored in an envelope, the examiner should be careful not to write on the envelope and cause indentations on the original document inside. Photocopies and laser-printed documents should always be stored in paper folders or envelopes, not transparent plastic envelopes, which can result in the copies sticking to the plastic and destroying some features of the document.
Lifetime Of Evidence
Evidence goes through various stages during an investigation. These stages represent the lifetime of evidence and include several key stages from the piece of evidence’s acquisition to its eventual disposal:
Acquisition of evidence by:
Collection, for example, at a crime scene;
Seizure;
Voluntary deposit
Sorting, which includes:
Indexing;
Describing;
Digitizing, for example, photographing or scanning.
Duty of care, to avoid instances where capturing evidence results in hindrance to the operations of the company. This includes
Copying of evidence;
Provision of copies to evidence owner.
Analysis, which includes:
Information processing, for example, translations of the content;
testing, for example of drug type, paper type, ink type;
Environmental context investigation, for example, age of evidence, fingerprints, and other forensic examination.
Assessment
Relevance of evidence to elements of proofs.
Presentation, which includes:
Disclosure, for example, pre-trial to defense;
In final reports;
In court, and an appeal.
Disposal, which can be by:
Returning to the owner in case of an original piece of evidence;
Destruction in case of a copy of the evidence, or of illicit, redundant, obsolete, sensitive, or confidential material;
Sale or donation, if no owner identifiable owner.
Responsibility And Accountability
Evidence is handled by various personnel and moved to various locations at every stage of its life. This movement and handling of evidence create challenges regarding tampering with evidence. If there is any indication of tampering of evidence, the evidence becomes inadmissible and can put the whole investigation in jeopardy.
To avoid the tampering of evidence during its lifetime, a strict chain of custody is put in place on the personnel involved in the handling of the evidence.
The challenges of a chain of custody can be minimized by digitizing evidence as it reduces the handling of the original evidence until it is presented. This reduction in handling decreases the likelihood of deliberate tampering or accidental contamination and reduces chain of custody requirements.
Final Thoughts
Evidence management is the administration and control of evidence related to an event so that it can be used to prove the circumstances of the event and so that this proof can be tested with confidence by independent parties that the evidence provided is the evidence collected related to the event.