7.1 Lawful Evidence Collection & Preservation
Key Takeaways
Before collecting an item, an investigator must establish lawful access, client authority, safety, ownership or custody, and whether police or a qualified specialist should handle it.
The first preservation steps are to secure the scene lawfully, document the item in place, minimize handling, and record who did what and when.
Different materials require different clean packaging and environmental controls; improvised collection can contaminate biological, chemical, trace, or digital evidence.
A write blocker and cryptographic hash support digital preservation but do not guarantee that a source was untouched, correctly acquired, or authentic.
Tennessee Rules of Evidence 901 and 1001–1005 address authentication and contents; duplicates are often admissible, but foundation, fairness, and authenticity still matter.
Lawful Evidence Collection & Preservation
Private investigators often document evidence; they do not automatically have authority to seize it. The first question is whether collection is lawful and wise.
Authority and safety
Before touching an item, determine:
- who owns or controls the location and item;
- whether the investigator has valid permission;
- whether law enforcement has jurisdiction over a crime scene;
- whether collection would obstruct an investigation or violate a court order;
- whether the material is hazardous, biological, sharp, explosive, or controlled; and
- whether a trained forensic professional is needed.
If the scene may involve an active crime, injured person, weapon, suspected drug, blood, fire origin, or hazardous material, protect life, avoid disturbance, and contact the appropriate authority. A client’s desire to “get the evidence first” does not authorize removal.
Document before handling
When lawful collection is appropriate:
- record date, time, location, collector, and authority;
- photograph the overall scene;
- photograph the item in relation to fixed features;
- take close views with an appropriate scale when useful;
- describe condition, orientation, container, and identifying marks;
- identify persons present; and
- assign a unique item number.
Do not reposition an object for a better photograph without recording the original position and the move. Avoid placing a scale on wet or fragile material.
Minimize contamination
Use clean gloves and tools appropriate to the material. Change gloves between items when cross-contamination is possible. Package items separately unless a qualified protocol requires otherwise.
General principles include:
- do not seal wet biological material in an airtight plastic bag without qualified direction;
- protect sharp items in rigid puncture-resistant packaging;
- do not clean, test, or mark a critical surface unnecessarily;
- use containers compatible with chemicals or liquids;
- preserve trace material from loss and transfer; and
- document every opening and resealing.
These are general preservation principles, not a substitute for a laboratory or agency protocol. If the investigator lacks training or storage capability, document the item and arrange qualified collection.
Documents and photographs
Preserve the original document when the client lawfully possesses it. Handle minimally, avoid new marks, and store it flat or in a suitable enclosure. Record staples, tears, handwriting, impressions, and order before separating pages.
A high-quality scan is useful for review, but keep the source and document the scanner or camera workflow. Tennessee Rule of Evidence 1003 generally permits a duplicate to the same extent as an original unless a genuine authenticity question exists or admitting the duplicate would be unfair. Rule 1005 addresses public-record contents.
A certified public record may offer a stronger foundation than a screenshot from an unofficial index. Authentication and hearsay are separate: proving that a document is genuine does not automatically prove every statement inside it is admissible for its truth.
Digital devices and data
Do not explore a phone, account, computer, or cloud service without confirmed authority. Consent should identify the device/account, scope, data types, and who may receive results. A shared device or known password does not always authorize access to every user’s data.
For a powered device, state can change through syncing, encryption, remote wipe, updates, or ordinary handling. Follow a qualified incident protocol rather than reflexively turning it on or off. Record screen state, connections, time, battery, and actions.
A forensic image should be made by a trained person with validated tools. A hardware or software write blocker is designed to prevent writes to compatible source media during acquisition. It reduces risk; it does not prove perfection. Misconfiguration, unsupported interfaces, prior alteration, tool errors, and acquisition scope still require documentation and validation.
Calculate cryptographic hashes of the source image and verified copies when appropriate. A matching hash supports byte-level identity of the compared data. It does not prove the source owner, lawful access, completeness of acquisition, or truth of user-created content.
Online and cloud evidence
Preserve the URL, account identifier, date/time/zone, visible context, original download where available, and collection method. A screenshot alone may omit metadata and surrounding content. Use provider preservation requests or legal process through counsel when account records are needed.
Do not log into an account with credentials supplied by a client until authority is confirmed. A spouse, employer, or parent may not own every account or communication on a shared device.
Packaging and item identification
A useful label includes case number, item number, description, source/location, collector, collection date/time, and hazard notation. Seal in a way that reveals opening and sign or initial across the seal as a practical control.
A signed seal is not “unforgeable” and does not conclusively prove no access. It is one part of a documented chain, together with controlled storage and transfer records.
Evidence rules
Rule 901 asks for evidence sufficient to support a finding that the item is what the proponent claims. The foundation may come from a knowledgeable witness, distinctive features, a process, metadata, custody, or other proof. The proponent need not eliminate every theoretical possibility of tampering.
Rules 1001–1005 address writings, recordings, photographs, originals, duplicates, and public records. Counsel decides the offered form and legal theory. The investigator’s role is to preserve options and report the process honestly.
Exam method
Choose lawful access, scene documentation before handling, separate appropriate packaging, minimal alteration, qualified digital acquisition, and preserved originals. Reject answers that authorize private seizure, guarantee perfection from one tool, or confuse authentication with admissibility.
What should an investigator do first with a potentially important item at a lawful scene?
Move it to better light
Clean it for clearer photographs
Document its original location and condition before handling
Give it to the client without a log
What does a properly used write blocker do?
Guarantee the device was never altered
Prove who created every file
Make consent unnecessary
Reduce the risk of writes to compatible source media during acquisition
When is a duplicate generally admissible under Tennessee Rule 1003?
To the same extent as the original unless authenticity is genuinely questioned or admission would be unfair
Never
Only if the original was destroyed
Whenever the investigator prefers it
Sections you finish are checked off in the contents.