The successful outcome of a criminal investigation is almost always directly related to:

“Crime scene management, and evidence management as a critical part of that, must be learned and incorporated into the investigator’s toolkit.”

Crime scene management skills are an extremely significant task component of investigation because evidence that originates at the crime scene will provide a picture of events for the court to consider in its deliberations. That picture will be composed of witness testimony, crime scene photographs, physical exhibits, and the analysis of those exhibits, along with the analysis of the crime scene itself. From this chapter, you will learn the task processes and protocols for several important issues in crime scene management. These include:

1. Note taking
2. Securing a crime scene
3. Evidence management
4. Scaling the investigation to the event

Topic 1: Note Taking

Although other documents will be created by the investigator to manage the crime scene, no other document will be as important to the investigator as the notebook. The notebook is the investigator’s personal reference for recording the investigation.

Many variations of police notebooks have emerged over the years. The court will sometimes even accept police notes that have been made on a scrap of paper if that was the only paper available at the time. However, beyond extreme circumstances, in operational investigations, the accepted parameters of a police notes and notebooks are:

• A book with a cover page that shows the investigators name, the date the notebook was started, and the date the notebook was concluded
• Sequential page numbers
• A bound booklet from which pages cannot be torn without detection
• Lined pages that allow for neat scripting of notes
• Each entry into the notebook should start with a time, date, and case reference
• Blank spaces on pages should not be left between entries and, if a blank space is left, it should be filled with a single line drawn through the space or a diagonal line drawn across a page or partial page space
• Any errors made in the notebook should only be crossed out with a single line drawn through the error, and this should not be done in a manner that makes the error illegible

In court, the investigator’s notebook is their best reference document. When testifying, the court will allow an investigator to refer to notes made at the time to refresh their memory of events and actions taken. When an investigator’s notebook is examined by the court, notes consistent with the investigator’s testimony provide the court with a circumstantial assurance or truthfulness that the evidence is accurate and truthful (McRory, 2014). Alternately, if critical portions of the investigation are not properly recorded or are missing from the notebook, those portions of the evidence will be more closely scrutinized by the defence. The court may give those unrecorded facts less weight in its final deliberations to decide proof beyond a reasonable doubt.

For an investigator, good notes are an overview of the things seen/heard and the actions taken. A chronology of notes demonstrates the investigator’s mental map of the facts that led to forming reasonable grounds for an arrest and charges. Court cases are often extended by adjournments, appeals, or suspects evading immediate capture. This can extend the time between the investigation and the trial by several years. In these protracted cases, it becomes critical for the investigator to have detailed notes that accurately reflect their investigation to trigger their memory of the facts.

As important as the notebook is, note taking skills are often an underemphasized aspect of police training. Most police investigators develop their personal skills and note taking strategies through on the job experience and in the “trial by fire” of cross examination in court. This void in the training of note taking skills is likely due to the broad range of circumstances under which note taking needs to take place and because it is impossible to anticipate what facts will become important in every possible variation of circumstances. Thus, some combination of training, common sense, and experience will come into play for investigators to become proficient in recognizing what to record in their notebook.

The concept of “notes made at the time of an event is a rather misleading definition and requires some explanation. In an ideal world, an investigator would be able to proceed through an investigation with an open notebook and record each fact and each observation of events as they transpire. Of course, the way events unfold is dynamic and unpredictable. Circumstances often require an investigator to be fully engaged in efforts to bring a situation under control, while protecting the life and safety of persons. There is no place for an open notebook in such cases and the investigator is clearly not taking any notes at that time, but will do so after the event is under control, and as soon as it is practical to do so. Although the typical reference in court is to notes made at the time, in actuality, they are notes made as soon as practical under the unique circumstances of the event.

The courts do accept the operational dynamics that exists for investigators, and it sometimes becomes a question at trial to know when the notes were actually composed. As such, an investigator should always be prepared to answer this question. Having a note in the notebook regarding the time when the writing of notes was and finished acts as a reference to demonstrate awareness and attention to this issue.

Another issue related to notes made at the time is the dilemma of facts that were overlooked and then recalled after the initial notes have been completed. The human memory does have its limitations and flaws. On occasion, an investigator will complete the initial draft of their notes, and, at some later time may suddenly recall a point that was missed. On such occasions, returning to the pages of notes made at the time and attempting to insert the recalled facts is not an acceptable practice. The proper way to record these later recollections of fact is to immediately start a new note page, using the current time and date, make a reference to the previous case-notes, previous time, date, and page number, and record the newly recalled fact or facts. These kinds of recalled facts and late entries will be closely examined by defence counsel, and it can sometimes be helpful if the investigator can also make note of the fact or circumstances that led to the recollection of the additional information. Anyone who has ever participated in a critical incident, where life and safety have taken priority, can tell you that once the event is under control, investigators can be seen writing intently to document their recollection of the events.

The following strategies are recommended as a general guide to note taking:

1. Start notes by creating a big picture perspective and then move from the general to the more specific observations. In this big picture, you are creating a perspective of the facts that you have been made aware of to begin an investigation. These big picture facts become the starting point of your mental map of events, and these facts will be the framework to begin thinking about offence recognition and forming reasonable grounds to believe and take action.
2. In more specific terms, and to the extent it is possible, begin recording all dates, times, and descriptions of persons, places, and vehicles as they emerge. You may, in fact, have already started a page in your notebook where some exact times, addresses, licence plate numbers, names or persons, and perhaps even blurted statements from a suspect have been jotted down. It is acceptable to use these key pieces of jotted information already recorded to enlarge your detailed notes at the end of the event in a more complete fashion.
3. Record the identities of persons encountered and how the identity of each person was verified. For example: Witness Jane Doe (DOB: 8 May 64) 34345-8 St Anywhere BC Photo drivers licence ID
4. Record all statements made by witnesses and victims to reflect an accurate account of the information being conveyed. It is often not possible to record every statement made verbatim in notes, and, in most cases, it is not necessary. Today, technology makes it possible to digitally record the verbatim account being provided by a witness or a victim. But, merely digitally recording a statement is not sufficient, since statements will frequently form considerations in establishing reasonable grounds for belief to take action. Recording the critical details being conveyed will provide a written record of the facts considered to form reasonable grounds for belief.
5. If a person is a suspect or is a person who may become a suspect, make every effort to record any statements made by that person verbatim. Suspects will often be found at the scene of a crime posing as a witness or even as a victim. Accurately recording the initial statements made by such a person can produce evidence of guilt in the form of statements that are provably false or even incriminating.

It is the personal responsibility of each investigator to document their personal perception and recollection of the event they are witnessing, as it unfolds. In cases where investigators have collaborated on an agreed version of events and authored their notes to reflect those agreed upon facts, the notes are no longer the personal recollection of that investigator and, as such, may be scrutinized as being a collective version of events aimed at producing evidence that does not reflect a true account of the facts as they were witnessed by each individual investigator.

The practice of collaborating and making collective notes is sometimes called “boxing of notes” — this practice can be discovered by defence when the individual notebooks of investigators are identical or close to identical in format and content. The practice of boxing of notes has been identified as one of the flaws in investigative practice that can lead to miscarriages of justice (Salhany, 2008). As such, collaboration between investigators when making notes should be avoided. If, at any point, there is a collaboration to return to an issue together and re-examine physical evidence to clarify the point for each investigator, that collaborative effort should be noted as part of the note making of each investigator.

Despite this caution regarding the collective production of notes, there are occasions where a collective note making process is used and is accepted as reasonable. This occurs during large scale operations involving many participants, sometimes coordinated by an Emergency Operations Command Center. In these cases, there is a need for the command centre participants to be completely engaged in handling the event, which may extend over periods of hours or days. The practice of each participant waiting until the protracted event has been concluded to make their individual notes would be impractical and potentially inaccurate. In these cases, it is now accepted operational practice to assign one person in the command centre to act as the collective maker-of-notes to substitute for individual note-taking. The note maker in these situations is known as “The Scribe.” For the persons in the command centre to be aware of the notes being made, the Scribe does not make notes into a typical notebook. In such cases, the notes are made onto large pieces of flipchart paper and, as each sheet of notes is completed, it is posted onto the wall of the command centre where each participant can reference the content of the notes and verify the accuracy of the notes. At the end of the operation, the collective pages of notes are photographed and the note pages are saved by the scribe as an exhibit. Each page is often initialled by the participants. Under this process, each participant in the command centre may adopt these notes as a reference document for court purposes.

Topic 2: Integrity of the Crime Scene

As part of crime scene management, protecting the integrity of the crime scene involves several specific processes that fall under the Tasks category of the STAIR Tool. These are tasks that must be performed by the investigator to identify, collect, preserve, and protect evidence to ensure that it will be accepted by the court. These tasks include:

a) Locking down the crime scene

b) Setting up crime scene perimeters

c) Establishing a path of contamination

d) Establishing crime scene security

When an investigator arrives at a crime scene, the need to protect that crime scene becomes a requirement as soon as it has been determined that the criminal event has become an inactive event and the investigator has switched to a strategic investigative response. As you will recall from the Response Transition Matrix, it is sometimes the case that investigators arrive at an active event in tactical investigative response mode. In these cases their first priority is to protect the life and safety of people, the need to protect the crime scene and its related evidence is a secondary concern. This is not to say that investigators attending in tactical investigative response mode should totally ignore evidence, or should be careless with evidence if they can protect it; however, if evidence cannot be protected during the tactical investigative response mode, the court will accept this as a reality.

As soon as the event transitions to an inactive event with a strategic investigative response, the expectations of the court, regarding the protection of the crime scene and the evidence, will change. This change means that there is an immediate requirement for the investigator to take control of and lock down that crime scene.

a) Locking Down the Crime Scene

Very often, when the change to strategic investigative response is recognized, first responders and witnesses, victims, or the arrested suspect may still be inside the crime scene at the conclusion of the active event. All these people have been involved in activities at the crime scene up to this point in time, and those activities could have contaminated the crime scene in various ways. Locking down the crime scene means that all ongoing activities inside the crime scene must stop, and everyone must leave the crime scene to a location some distance from the crime scene area. Once everyone has been removed from the crime scene, a physical barrier, usually police tape, is placed around the outside edges of the crime scene. Defining of the edges of the crime scene with tape is known as establishing a crime scene perimeter. This process of isolating the crime scene inside a perimeter is known as locking down the crime scene.

b) Crime Scene Perimeter

The crime scene perimeter defines the size of the crime scene, and it is up to the investigator to decide how big the crime scene needs to be. The size of a crime scene is usually defined by the area where the criminal acts have taken place. This includes all areas where the suspect has had any interaction or activity within that scene, including points of entry and points of exit. The perimeter is also defined by areas where the interaction between the suspect and a victim took place. In some cases, where there is extended interaction between a suspect and a victim over time and that activity has happened over a distance or in several areas, the investigator may need to identify one large crime scene, or several smaller crime scene areas to set crime scene perimeters. Considering the three stages of originating evidence, an investigator may find that pre-crime or post-crime activity requires the crime scene perimeter to surround a larger area, or there maybe even be an additional separate crime scene that needs to be considered.

For some crime scenes where there are natural barriers, such as buildings with doorways, it is easy to create a crime scene perimeter defining access. This becomes more complicated in outdoor venues or large indoor public venues, where fencing and barricades may be needed along with tape markers to define the perimeters.

Once the crime scene perimeter has been established and lock down has taken place, it becomes necessary to ensure that no unauthorized persons cross that perimeter. Typically, and ideally, there will only be one controlled access point to the crime scene, and that point will be at the entry point for the path of contamination.

c) Path of Contamination

It is not possible to eliminate all potential contamination of a crime scene. We can only control and record ongoing contamination with a goal to avoid damaging the forensic integrity of the crime scene and the exhibits. Once a crime scene has been cleared of victims, witnesses, suspects, first responders, and investigators, it is necessary to record, in notes or a statement from each person, what contamination they have caused to the scene. The information being gathered will document what evidence has been moved, what evidence has been handled, and by whom. With this information, the investigator can establish a baseline or status of existing contamination in the crime scene. If something has been moved or handled in a manner that has contaminated that item before the lock down, it may still be possible to get an acceptable analysis of that item if the contamination can be explained and quantified.

As an example, sometimes in cases of serious assaults or even murders, paramedics have been present at the scene treating injured persons. When this treatment is happening, non-suspect-related DNA transfer between persons and exhibits can occur. Determining those possibilities is one of the first steps in establishing the level of existing contamination at the time of lock down.

With everyone now outside the crime scene and the perimeter locked down, the next step is to establish a designated pathway where authorized personnel can re-enter the crime scene to conduct their investigative duties. This pathway is known as a path of contamination and it is established by the first investigator to re-enter the crime scene after it has been locked down. Prior to re-entering, this first investigator will take a photograph showing the proposed area where the path of contamination will extend, and then, dressed in the sterile crime scene apparel, the investigator will enter and mark the floor with tape to designate the pathway that others must follow. In creating this pathway, the first investigator will avoid placing the pathway in a location where it will interfere with apparently existing evidence and will place it only where it is required to gain a physical view of the entire crime scene. As other investigators and forensic specialists enter the crime scene to perform their duties, they will stay within the path of contamination and, when they leave the path to perform a specific duty of investigation or examination, they will record their departure from the path and will be prepared to demonstrate their departure from the pathway and explain any new contamination caused by them, such as dusting for fingerprints or taking exhibits.

d) Crime Scene Security

At the same time the crime scene is being defined with perimeter tape, it is also necessary to establish a security system that will ensure that no unauthorized person(s) enters the crime scene and causes contamination. For this purpose, a crime scene security officer is assigned to regulate the coming and going of persons from that crime scene. For the assigned security officer, this becomes a dedicated duty of guarding the crime scene and only allowing access to persons who have authorized investigative duties inside the crime scene. These persons might include:

• Forensic specialists
• Search team members
• Assigned investigators, and/or
• The coroner in the case of a sudden death investigation

To maintain a record of everyone coming and going from the crime scene, a document, known as a “Crime Scene Security Log,” is established, and each authorized person is signed in as they enter and signed out as they depart the scene with a short note stating the reason for their entry. Any unauthorized person who enters or attempts to enter a crime scene should be challenged by the crime scene security officer, and, if that person refuses to leave, they can be arrested, removed from the scene, and charged for obstructing a police officer.

The assigned security officer is responsible for creating and maintaining the Crime Security Log, which can take various forms. In short term, small scale investigations, it may only require a single page in the security officer’s note book; however, in a large scale, long term investigation, the log could include volumes of pages under the care of several assigned security officers working in shifts. Whatever the scale or format, the security log records who attended the scene, when they attended, why they were there, and when they left the scene. An example of a crime scene security log is shown in the following example.

Topic 3: Evidence Management

As we have already learned in the STAIR tool, analysis is the process that must occur to establish connections between the victims, witnesses, and suspects in relation to the criminal event. The crime scene is often a nexus of those events and consequently, it requires a systematic approach to ensure that the evidence gathered will be acceptable in court.

Exhibits, such as blood, hair, fibre, fingerprints, and other objects requiring forensic analysis, may illustrate spatial relationships through evidence transfers. Other types of physical evidence may establish timelines and circumstantial indications of motive, opportunity, or means. All evidence within the physical environment of the crime scene is critically important to the investigative process. At any crime scene, the two greatest challenges to the physical evidence are contamination and loss of continuity.

Contamination of Evidence

Contamination is the unwanted alteration of evidence that could affect the integrity of the original exhibit or the crime scene. This unwanted alteration of evidence can wipe away original evidence transfer, dilute a sample, or deposit misleading new materials onto an exhibit. Just as evidence transfer between a suspect and the crime scene or the suspect and the victim can establish a circumstantial connection, contamination can compromise the analysis of the original evidence transfer to the extent that the court may not accept the analysis and the inference that the analysis might otherwise have shown.

Contamination can take place in any number of ways including:

• Police or other first responders interfering with evidence during a tactical investigative response
• Suspects interfering with the crime scene to cover up or remove evidence
• Victims or witnesses handling evidence
• Animals, including pets, causing unwanted transfer of evidence or even removal of evidence through contact or consumption
• Weather-related contamination due to rain, wind, or snow diluting or washing away evidence, or
• Crime scene investigators failing to follow proper crime scene management procedures and causing contamination of exhibits or cross-contamination between exhibits during their investigation

Contamination is a fact of life for investigators, and any crime scene will have some level of contamination before the scene becomes an inactive event and the police can lock down the location. While issues of life and safety are at risk, the court will accept that some contamination is outside the control of the investigator. That tolerance for controlling contamination changes significantly once the crime scene is locked down and is under control. Once the scene has been locked down, crime scene management procedures must be put in place. Crime scene contamination presents three challenges for investigators, namely:

1. Preventing contamination when possible,
2. Controlling ongoing contamination, and
3. Recording the known contamination that has taken place

In regards to the phrase “control ongoing contamination,” the word “control” is used because investigators cannot eliminate ongoing contamination, they can only seek to control it. This practice of identifying and recording the known contamination is necessary, and even if contamination has taken place, identifying and explaining that contamination may salvage the analysis of exhibits that have been contaminated.

During the critical period between the lockdown of the crime scene and obtaining a warrant to search the crime scene, investigators need to consider the possibilities for ongoing contamination. If reasonable grounds exist to believe that evidence of the crime will be damaged or destroyed by some threat of contamination, the investigator has the authority, under exigent circumstances, to re-enter that crime scene without a warrant to take the necessary steps to stop or prevent contamination and protect the evidence.

The very act of entering the crime scene to collect evidence, and the process of evidence collection, are forms of contamination. The goal in controlling ongoing contamination is to avoid damaging the forensic integrity of the crime scene and its associated exhibits. It is this goal that makes crime scene management procedures essential to the investigative process.

Loss of Continuity

Like controlling contamination, establishing and maintaining continuity of evidence are protocols that protect the integrity of that evidence. For any evidence to be accepted by the court, the judge must be satisfied that the exhibit presented is the same item that was taken from the crime scene. Evidence must be presented to demonstrate “the chain of continuity,” which tracks every exhibit from the crime scene to the courtroom.

The evidence to show continuity will come from the investigator testifying that the exhibit being presented is the same exhibit that was seized at the crime scene. This testimony is supported by the investigator showing the court their markings on the exhibit or its container. These markings will include the time, date, and investigator initials, as well as a notebook entry showing the time, date, and place when the item was transported and locked away in the main exhibit holding locker. This evidence is further supported by an Exhibit Log that shows the exhibit as part of the crime scene evidence detailing where at the crime scene it was found, by whom it was found, and the supporting initials of anyone else who handled that exhibit from the crime scene continuously to the main exhibit locker. Any process where that exhibit is removed from the main exhibit locker for examination or analysis must be similarly tracked and documented with the initials, time, and date of any other handlers of the item. Any person who has handled the exhibit must be able to take the stand providing testimony that maintains the chain of continuity of the exhibit. These are simple processes yet critical. If they are not followed rigorously, it can result in the exclusion of exhibits based on lost continuity.

Attention to Originating Stages of Evidence

One of the big dilemmas in crime scene management is determining where the criminal event happened or where the event extended to. Making these determinations provides the investigator with the locations where evidence of the crime may be found. This is often not a simple matter of just attending one location or thinking about the criminal event in just a single timeframe. In the investigative process, there are three possible stages of time where evidence can originate. These are the pre-crime stage, the criminal event stage, and the post-crime stage.

These three stages of crime can also mean there could be other locations outside the immediately crime scene area where criminal activities might have also taken place and evidence might be found. The point to remember about the originating stages of evidence is that each of these stages provides possibilities for collecting evidence that could connect the suspect to the crime. When considering theory development or making an investigative plan, each of these stages of the criminal event should be considered.

1. The Pre-Crime Stage occurs when evidence of preparation or planning can be found during the investigation. It can include notes, research, drawings, crime supplies or pre-crime contact with the victim or accomplices. Sometimes items of pre-crime origin, such as hair and fibre, will be later discovered at the crime scene creating an opportunity to link the suspect back to the crime
2. The Criminal Event Stage is when the most interaction takes place between the criminal and the victim, or the criminal and the crime scene. During these interactions, the best possibilities for evidence transfer occur. Even the most careful criminals have been known to leave behind some trace of their identity in the form of fingerprints, shoe prints, glove prints, tire marks, tool impressions, shell casings, hair or fibre, or DNA.
3. The Post-Crime Stage occurs when the suspect is departing the crime scene. When leaving the crime scene, suspects have been known to cast off items of evidence that can be recovered and examined to establish their identity. This post-crime period is also the stage where the suspect becomes concerned with cleaning up the scene. As much as a suspect may attempt to clean up, evidence transfers from the crime scene are often overlooked. These can range from hair and fibre on clothing to shards of glass on shoes. Frequently found post-crime are proceeds of the crime. These are often identifiable articles of stolen property with unique marks, victim DNA, serial numbers, or sometimes even trophies that the criminal takes as a keepsake.

Evidence does not always appear as a fully formed piece of information that offers an immediate connection or an inference to implicate a suspect. It often comes together as fragments of fact in timelines, spatial relationships, and evidence transfers between the originating stages of evidence constructing circumstantial pictures to demonstrate the suspect’s identity, the fact pattern of the crime, opportunity, means, or motive and intent.

Enhancing the Value of Evidence Recovered

Pieces of physical evidence often referred to as exhibits, have investigative values at two different levels for investigators. At the first level each physical exhibit has a face value represented by what it is and where it exists within the context of the crime scene. For example a bloody shoeprint found on the floor of a crime scene tells us that someone transferred evidence of blood onto their shoe from a source and walked in a particular direction within the crime scene. These are first level interpretations of evidence that we can reconstruct with our own observations. At the second level this same bloody shoeprint may be subjected to forensic examinations that could provide additional information. For example analysis of the shoeprint pattern, size, and accidental characteristics may allow a positive match to the shoe of a suspect, or the blood may be examined to match the DNA of a victim or other originating source. Both these first level and second level values can greatly assist in creating a reconstruction and interpretation of what happened at the crime scene.

Physical exhibits that need to be examined, seized, and documented at any crime scene are a major concern for investigators. As mentioned earlier, one of the big challenges for investigators is to identify and document all of the available evidence and information. This raises the important questions of what will become evidence and what is going to be important?

When the suspect and the fact-pattern are not immediately apparent, how does an investigator determine which items within the crime scene need to be considered and taken as possible evidence? There are some general practices that can be followed, but a guiding principle of evidence collection followed by most experienced investigators is to err on the side of caution. More is always better than less. To assist in deciding what could possibly become relevant, investigators need to consider:

• Items that the suspect may have touched or interacted with
• Items that a victim may have touched or interacted with
• Items that the suspect may have brought to the crime scene
• Items that may have passed between the suspect and the victim
• Items that the suspect may have taken from the crime scene
• Items that the suspect may have discarded while departing the crime scene

Once the crime scene examination has been completed, and the crime scene has been unsecured and abandoned as an open area, returning to collect forgotten evidence is often not possible. It is better to collect everything that could possibly be relevant or could become relevant.

In terms of searching for evidence, once the crime scene has been locked down and secured, the crime scene itself needs to be considered as the first big exhibit. As the first big exhibit, it needs to be subjected to documentation using photography, video recording, measurements, and diagrams. Within this first big exhibit, other smaller and possibly-related exhibit may be discovered. What items are found and where may show spatial relationships of interaction demonstrating proof to support a sequence of events. This physical evidence will become the benchmark of known facts that investigators can use to verify the stories of victims and witnesses, or even the alibi of a possible suspect. Physical evidence at both level-one and level-two becomes the known facts upon which theories of events may be developed and tested. Any item could be considered evidence if it demonstrates a spatial relationship relative to the place, the people, or the times, relative to the criminal event.

The very first step at this point is securing and documenting the crime scene. It is helpful for investigators to recognize that a crime scene is not just a location where exhibits are found, but the crime scene should be considered as a single big exhibit unto itself. Not only will individual exhibits within the crime scene have value as evidence, the spatial relationships between exhibits in the scene may speak as circumstantial evidence to the overall event.

To secure the crime scene as the first big exhibit, investigators will conduct a complete walk-through on the path of contamination completely photographing and videotaping the entire crime scene. This first process is very helpful in demonstrating the exact state of the crime scene prior to things being moved for forensic examination. This should happen immediately after lock down and it will become a snapshot demonstrating the existing spatial relationships at that point in time.

Creating a Field Sketch and Crime Scene Diagram

The next step is to document the crime scene as either a field sketch or a crime scene diagram. Either of these can be done to illustrate the physical dimensions and notable characteristics of the crime scene. The difference between the Field Sketch and the Crime Scene Diagram is that the sketch, as implied by the name, is a quick rough depiction of the event. The field sketch, like notes in an investigator’s notebook, serves as a memory aid. The crime scene diagram is a more formal representation of the same information, but is composed to scale using the assistance of the field sketch and measurements. In either of these drawings of the crime scene similar core information will be represented.

• If it is a building, it will show the address of the location, entries, exits, windows, the position of rooms, the position of furniture, and the location of all exhibits relative to the crime.
• In an outdoor crime scene, establishing and documenting the location of the scene becomes more complex. The geographic location of an outdoor scene needs to be established relative to some known geographic location, such as a roadway intersection, a mile-marker, or even by way of fixing of GPS coordinates of latitude and longitude to a permanent fixed object at the crime scene. In some cases, such as a large open field, where no permanent fixed objects are available, it may become necessary to place a fixed object like a steel survey pin to mark a fixed point at the crime scene.
• After the initial diagram features are completed and evidence is collected within the crime scene, each of those exhibits will be shown on the diagram with an exhibit number. That number will be cross referenced to the exhibit log that will be completed by an assigned exhibit custodian as part of the crime scene management team. This process of showing each exhibit as a number eliminates the need to clutter the diagram with written description of each exhibit found. In some cases, where there are many exhibits, writing the description of each exhibit onto the diagram would make it unreadable, cluttered, and confusing.
• In addition to existing features and evidence at the crime scene, the diagram will also show the location of the path of contamination that has been established and the external perimeter of the crime scene.
• As part of accepted protocols, these diagrams are always drawn with an orientation to North at the top of the diagram, and all writing on the diagram is oriented in one direction, namely east to west

The Exhibit Log

As part of the evidence management process, establishing the first link in the chain of continuity occurs when the crime scene is secured and the assigned exhibit custodian records of the exhibits that have been identified at the scene is created. These items are recorded in a document called an “Exhibit Log” or an “Exhibit Ledger.” This Exhibit Log or Ledger shows an assigned number for each exhibit that is identified and seized. It shows where at the scene the exhibit was located, and the number of that exhibit is place in the corresponding location in the crime scene diagram.

The Exhibit Log shows who seized the exhibit and when it was turned over to the exhibit custodian. The Exhibit Log also shows a time and date when the exhibit was placed into the main secure exhibit storage locker. When the exhibits are taken to court, the court will only accept the exhibits if the secured chain of continuity can be shown to be guarded and unbroken. If an exhibit custodian were to stop and leave the exhibits unguarded in a vehicle or left the exhibit in the office while attending to another matter – that would break the chain of continuity. The following document is an example of a common Exhibit Log Document.

Evidence at a crime scene is generally found in two forms. One is evidence of witnesses who can provide their observations of the criminal event. The other is physical items of evidence that can be examined, analyzed, and interpreted to illustrate facts about the criminal event. Each of these forms of evidence present some similar concerns for investigators, and each requires some specific considerations to best search for, collect, and preserve the information that exists.

Searching for Witness Evidence

Identifying and interviewing the witnesses to a criminal event can be as simple as speaking to persons who have remained at the scene of the crime to give statements. Alternately, it can be as difficult as identifying and tracking down a person who saw something or heard something that was part of the criminal event, but they are not even aware that what they saw or heard was important, or they do wish to cooperate with the police.

The process searching for witnesses starts at the crime scene itself. This search will include not only identifying and interviewing the persons who are immediately present, but also determining who else might have been present during the pre-crime and post-crime stages of the event.

• Often, witnesses remaining at the crime scene can assist in identifying other witnesses who were present and have since departed.
• CCTV security cameras can sometimes assist in identifying other witnesses who were present.
• Identifying the vehicles parked in proximity to the crimes scene or returning to the crime scene on subsequent days around the time of the crime can assist in identifying a witness whose normal course of activities may have previously put them in the area at the time of the crime.

In addition to these witness search strategies, another process known as canvassing for witnesses can also be employed. Canvassing is a strategy of conducting door-to-door inquiries in the immediate area of the crime to determine if anything was seen or heard by neighbours. Canvassing can also take the form of structured media releases to request persons with knowledge of the criminal event to come forward. Whatever witness identification strategies are used, time is of the essence. Memories fade and people under normal circumstances only retain day-to-day recollection of unremarkable events for a limited time. Identifying and speaking to the witness, and receiving their best recollection of the events, will be discussed in the chapter on witness management; however, witness evidence can make or break the investigation, and it must be collected quickly, accurately, and effectively.

Searching for and Identifying Physical Evidence

Earlier in this book, we described physical evidence as the buried treasure for investigators and critical when it comes to verifying or discounting various versions of an event in court. Physical evidence is something tangible that the court can examine and consider in making connections and determining proof beyond a reasonable doubt. In contrast, witness evidence does not have a physical quality that the court can observe. It requires the court to accept the perception and interpretation of events being provided by a person and, as such, the court cannot evaluate witness evidence with the same confidence of verification that it uses when considering physical evidence.

In our sub-section on Originating Stages of Evidence, we looked at the timeframes and alternate crime scene venues where evidence of a crime may be found. Now, we are going to consider the physical evidence that investigators should think about when evaluating what might constitute an item of physical evidence. We will consider how evidence can be searched for, how it should be collected, when it should be collected, and how it should be preserved. These processes present several challenges:

1. Physical evidence can be transient or time sensitive. As part of the big picture search in the first instance, the investigator must be conscious of physical evidence that needs to be immediately recorded and documented.
2. Physical evidence can be concealed and may not be easily visible. Walking onto a crime scene in the first instance, it would be unrealistic for an investigator to believe they will immediately see all the physical evidence that needs to be collected. Items of physical evidence can exist in many forms and discovering their existence is a matter of careful examination of the entire scene. The idea of conducting a big picture search first allows the investigator to not only discover the immediately apparent items, but also for a survey of the crime scene to determine areas where the small scale and more detailed search might be productive.
   • Doors and windows: open, locked, or unlock can be relevant to time and means of entry or exit from the scene
   • Condition of room lighting: turned on or off can suggest the lighting conditions at the time of the crime
   • Status of appliances in use at the scene can indicate certain activities
   • Last activation of electronic devices can narrow timelines of activity
   • Ambient crime scene temperature and body temperature can be relevant in relation to time of death and the progress rigor mortis or decomposition
3. The immediate value of an item may not be visible at first glance. Moving from the big picture search to identify items in the smaller scale search, investigators can conduct a detailed grid search of the crime scene to locate items that may be very small or are concealed by other objects. These grid searches can be useful in breaking down the crime scene into smaller search areas to make sure that no area goes unexamined. Along with this detailed search for small or concealed items, the investigator needs to consider enlisting the assistance of forensic specialists to search for items that may require enhanced examination and analysis beyond the bounds of regular human senses and perception. For example, the use of black light can reveal body fluid or stains, and latent fingerprints can become visible after fuming or the application of special powder. In most major criminal cases, forensic specialists will be available to assist in conducting the detailed crime scene search. Every investigator must be proficient in recognizing when to utilize of these forensic tools.
4. The size or nature of an item of evidence may make it impossible to seize or preserve. Among the challenges of gathering evidence at a crime scene are:
   • Some exhibits are too big to be physically seized and brought to court. As previously noted, the entire crime scene and the inherent spatial relationships of objects within that scene could be considered as one big exhibit that needs to be shown to the court. This big crime scene exhibit is captured and can be presented to the court by way of video recording, photographs, crime scene diagram, or using a sample of smaller exhibits within the scene itself.
   • Some exhibits are perishable and impractical to seize and preserve for court. A good example would be the evidence of the dead body in a murder case. The body itself would be impractical to bring to court. It is considered adequate to have photographic evidence and certificates of analysis on pathology samples.
   • Some exhibits are transient in nature and cannot be permanently seized and preserved for court. For example, ambient room temperature or lighting status at the crime scene needs to be preserved by photographs and measurements in that moment of time and subsequently presented to the court as photographs and readings by the attending investigator.
5. The collection of certain evidence can cause cross-contamination to other exhibits. A major consideration in the collection of any evidence at a crime scene is to ensure that evidence with any potential for cross-contamination is handled in a manner that takes precautions against this occurring. In most cases, at major crime scenes, physical evidence is collected by forensic experts. However, this does not preclude the need for investigators to understand the dangers of cross-contamination and the precautions required to prevent it. This is particularly true when it comes to the collection of bodily substances where DNA might be collected. DNA analysis is now so advanced that even a small trace of DNA material can be transferred by the careless or inadvertent handling of one exhibit to the next. This cross-contamination can be avoided or prevented by the practice of handling only one exhibit at a time, marking that exhibit, placing into a secure container, and decontaminating the investigator by changing gloves and discarding any item could have come into contact with the previous exhibit. Despite the assurance that forensic specialists will normally attend a crime scene for evidence collection, it is possible that an investigator at the scene will be forced to handle a number of exhibits to protect that evidence from some type of environmental damage or other security threat.

Topic 4: Scaling the Investigation to the Event

Not every crime scene is a major event that requires an investigator to call out a team and undertake the crime scene and evidence management processes that have been described in this book. Often, for minor crimes, a single investigator will be alone at the crime scene and will engage in all the roles described, albeit on a far smaller scale. When this process is being undertaken by a single investigator on a smaller scale, the issues of diagram, security log, and exhibit log may be limited to data and illustrations in the notebook of the investigator.

It is important to stress that each of the tasks below needs to be considered and addressed for every crime scene investigation, no matter how big or how small. Specifically:

• The crime scene must be secured, preserved, and recorded until evidence is collected
• Existing contamination must be considered and recorded
• Cross-contamination must be prevented
• Exhibits must be identified, preserved, collected, and secured to preserve the chain of continuity.

Large scale or small scale, all these issues must be considered, addressed, and recorded to satisfy the court that the crime scene and the evidence were handled correctly.

Summary

In this chapter, we have discussed the critical issues of crime scene management, evidence identification, evidence location, evidence collection, evidence protection, and proper documentation. These are the most important skills that an investigator can learn and incorporate into their investigative toolkit. As much as these tasks may seem simplistic, ritualistic, and mundane, they are the very foundation of a criminal investigation, and without this foundation of proper evidence practices in place, the case will collapse when it comes to court.

There is a great opportunity on a day-to-day basis for new investigators to begin practicing the protocols of crime scene management on a smaller scale investigating crimes such as break and entry and lower level assaults. Once these skills of crime scene management and evidence management are learned and incorporated into daily practice, they will become the procedural norm and will form the essential operational habits for proper and professional investigative practice.

Long Descriptions

Crime scene security log long description: A blank crime scene security log. It has spaces to write down the name of the assigned scene security officer, the date, the police department investigating the scene, the file number, and the crime scene location. It also has a table with several rows to record everyone who has attended the crime scene. The table has spaces for name and rank, initials, date/time in, date/time out, duties on crime scene, and contamination caused. [Return to Crime scene security log]

The originating stages of evidence long description: A chart showing what happens at the different originating stages of evidence. The three stages are:

• Pre-crime stage
  • Planning
  • Notes
  • Research
  • Crime supplies
• Criminal event stage
  • Most transfer of physical evidence
  • Suspect to Victim
  • Victim to Suspect
  • Suspect to Scene
• Post-crime stage
  • Avoiding apprehension
  • Casts-off evidence
  • Evidence of clean-up
  • Transfer takeaway
  • Proceeds of the crime

[Return to The originating stages of evidence]

Exhibit log long description: A sample exhibit log. There is room to write the name of the assigned exhibit custodian, the date, the file number, and the location. There is a table with several rows for writing about the exhibits from a crime scene. There are spaces for the exhibit number, description, who the exhibit was seized by, the date/time, the location, when the exhibit was turned over to the exhibit custodian, and the date/time secured. [Return to Exhibit log]