Evidence collection procedures are the step-by-step rules that govern how police and forensic personnel locate, document, package, transport, and store items used to prove a criminal case. Each step has a legal and scientific purpose: the Fourth Amendment controls whether officers can collect at all, scene documentation and packaging protect the item’s physical integrity, and the chain of custody proves nothing was swapped or altered between the crime scene and the courtroom. A failure at any stage can get the evidence excluded, regardless of how incriminating it is.
Lawful Authority to Search and Seize
The Fourth Amendment protects people against unreasonable searches and seizures by the government.1Legal Information Institute. Fourth Amendment Officers generally need a warrant before they can search a location or seize property. A warrant requires a sworn statement to a judge establishing probable cause, and the warrant itself must describe the specific place to be searched and the items to be seized.
Several recognized exceptions let officers collect evidence without a warrant:
- Consent from someone with authority over the location.
- Exigent circumstances, where delay would allow evidence to be destroyed, a suspect to flee, or someone to be harmed.
- Plain view, when an officer who is lawfully present sees something clearly incriminating sitting in the open.
- Search incident to a lawful arrest, covering the person and the area within arm’s reach. In Riley v. California, the Supreme Court held this exception does not reach the digital contents of a cell phone.
- The automobile exception, which allows a warrantless search of a vehicle when officers have probable cause to believe it contains evidence.
When Evidence Is Collected Illegally
Evidence obtained through an unconstitutional search is excluded from trial under the exclusionary rule. The Supreme Court applied the rule to state courts in Mapp v. Ohio, holding that evidence obtained by searches and seizures in violation of the Constitution is inadmissible in state court.2United States Courts. Mapp v Ohio Podcast
The rule reaches beyond the item itself. Under the fruit of the poisonous tree doctrine from Wong Sun v. United States, evidence discovered as a result of an illegal search is also excluded.3Justia US Supreme Court. Wong Sun v United States, 371 US 471 (1963) If an illegal search of a home turns up a receipt leading officers to a storage unit, the contents of that unit are excluded as well, even if the second search had its own warrant.
Three exceptions can save tainted evidence. It survives if investigators show it came from a truly independent source, if they would have inevitably discovered it through lawful means, or if the link between the illegal act and the evidence has become so remote the taint has dissipated. Officers who conduct unconstitutional searches can also face personal civil liability under 42 U.S.C. § 1983.4Office of the Law Revision Counsel. 42 USC 1983 – Civil Action for Deprivation of Rights
Documenting the Scene Before Anything Is Touched
Before investigators pick up a single item, they create a permanent record of how the scene looked on arrival. If the defense can argue investigators rearranged items before documenting them, the entire collection effort becomes suspect.
Photography follows a sequence from wide-angle shots of the overall layout, to mid-range images showing items in context, to close-ups taken both with and without a measurement scale next to the item. Investigators write field notes recording temperature, weather, lighting, and arrival and departure times.5Federal Bureau of Investigation. Crime Scene Investigation – A Guide for Law Enforcement Scaled sketches use measurements from fixed reference points such as walls and doorframes to map where each item sat in relation to the others. Photos, notes, and sketches together form the baseline every later analysis builds on.
Searching the Scene Systematically
Investigators pick a search pattern suited to the size and layout of the scene so no area goes unexamined.
- Grid, or double-strip: parallel passes in one direction, then a second set of passes perpendicular to the first. Thorough and common outdoors.
- Strip, or line: a single set of parallel lines, used for large open areas like fields or parking lots.
- Spiral: moving inward from the perimeter or outward from a central point, suited to smaller indoor scenes with a clear focal point.
- Zone: dividing the scene into sections and searching each independently, used in multi-room buildings.
When an item of interest is found, a numbered placard goes down beside it before anyone touches it. Each object gets a unique alphanumeric identifier tied to the master evidence list, linking the physical item to the photographs, sketches, and notes already created. That cross-reference is what lets a prosecutor hold up an item in court months later and trace it back to the exact spot where it was found.
Packaging Physical Evidence
Packaging depends on what the evidence is. The wrong container can destroy the item.
Biological Materials
Wet biological samples such as blood or saliva go into breathable paper containers, never plastic. Sealing moisture inside plastic creates ideal conditions for mold and bacteria, which degrade DNA. Once air-dried, the sample can be sealed in paper for transport. DNA evidence is highly sensitive to heat and humidity, and long-term storage standards from NIST call for keeping dried biological items frozen at or below -10°C (14°F) and humidity below 25% for refrigerated samples.6National Institute of Standards and Technology. The Biological Evidence Preservation Handbook – Best Practices for Evidence Handlers
Trace Evidence
Hairs, fibers, and paint chips are secured using a druggist fold, also called a bindle.7National Institute of Standards and Technology. Trace Evidence Collection – Paper/Druggist Fold A clean sheet of paper is folded into a pocket that traps the sample without adhesive touching it, and the fold goes into a sealed envelope. Dropping a hair directly into an envelope risks losing it through the seams or sticking it to the adhesive. The fold itself is not tape-sealed, because removing tape later could damage the sample.
Firearms and Other Dry Items
Dry items like tools, clothing, and documents go into sturdy paper bags or cardboard boxes sealed with tamper-evident tape. The person sealing signs across the tape so any later opening leaves a visible mark. Firearms are secured in rigid containers with zip-ties to prevent movement and accidental discharge. Hazardous materials are often heat-sealed or double-bagged to protect lab technicians.
Every package, regardless of contents, carries a label showing the case number, the item’s unique identifier, a description, the date and time of collection, and the collector’s name. Sloppy labeling creates chain of custody problems quickly: if a lab opens a box and the label does not match the log, the item’s reliability is already in question.
Collecting Digital Evidence
Digital evidence is the fastest-growing category of material in criminal cases and also the easiest to alter by accident. Turning on a computer changes timestamps. Opening a file modifies its access record. Even connecting to a network can trigger background processes that overwrite data.
Securing the Device
Investigators first document the device’s current state: whether it is powered on or off, what is on the screen, and what peripherals or cables are attached. If a computer is running, examiners may perform a live acquisition of volatile data such as active memory before powering down. If it is already off, the rule is simple: do not turn it on.8Scientific Working Group on Digital Evidence. Best Practices for Digital Evidence Collection For desktops, investigators pull the power cable from the back of the machine. For laptops, they disconnect the charger and remove the battery when possible. Network connections are severed immediately to prevent remote wiping.
Forensic Imaging and Hash Verification
Examiners never work directly on the original storage device. They create a forensic image, a bit-for-bit copy of every sector including deleted files and hidden areas, and all analysis happens on the copy. To prove the copy matches the original, examiners generate a cryptographic hash: a digital fingerprint unique to that exact set of data, where changing a single bit produces a completely different value. Hashing should happen as early as possible, and hash values should be stored separately from the evidence itself, typically in a case management system or printed documentation beyond the examiner’s control.9National Institute of Standards and Technology. NIST IR 8387 – Digital Evidence Preservation A failed hash comparison compromises the integrity of that evidence, though block-level hashing can sometimes isolate the problem to a specific portion of the data.
Packaging Digital Devices
Digital media is sensitive to static electricity, magnetic fields, temperature extremes, and physical shock. Devices are wrapped in anti-static material before being placed in sealed envelopes, bags, or boxes. A dropped hard drive or exposure to a strong magnet can destroy data as surely as deliberate deletion.
The Chain of Custody
The chain of custody is a written record tracking every person who handles a piece of evidence, from collection to courtroom presentation. Its purpose is to prove that the item a jury sees is the same item investigators found, in the same condition, with no opportunity for tampering.10National Institute of Justice. Law 101 – Legal Guide for the Forensic Expert – Chain of Custody
Every transfer requires both the person handing over the item and the person receiving it to sign the log. Each entry records who took possession, when, why, and where the item was stored, creating an unbroken timeline from scene to evidence locker to laboratory to courtroom.11National Institute of Justice. Law 101 – Legal Guide for the Forensic Expert – A Chain of Custody Typical Checklist
A gap in the log, even a brief period without a signature accounting for the item, gives the defense an opening to argue the evidence is unreliable. That argument does not always succeed; judges weigh the severity of the gap against the overall record. For digital evidence, the chain of custody starts at collection, before the hash value is generated, and the hash log itself becomes part of the chain’s documentation.12Scientific Working Group on Digital Evidence. SWGDE Position on the Use of MD5 and SHA1 Hash Algorithms in Digital and Multimedia Forensics
Challenging Evidence Authenticity in Court
Under Federal Rule of Evidence 901, the side offering a piece of evidence must produce enough proof to support a finding that the item is what they claim it is.13Office of the Law Revision Counsel. Rule 901 – Authenticating or Identifying Evidence In criminal cases, that burden falls on the prosecution. If the defense shows meaningful gaps in the chain of custody, inconsistent labeling, or missing documentation, the judge may exclude the evidence entirely or instruct the jury to weigh it with skepticism.
Defense attorneys attack the chain link by link. Common targets include periods where no one signed for an item, evidence stored in unsecured areas, containers with broken or missing tamper-evident seals, and transfer logs that do not match laboratory intake records. For digital evidence, a missing or mismatched hash value can serve as proof that data was altered after collection. The prosecution does not need a perfect chain, but it must show the evidence is in substantially the same condition as when it was collected. The more serious the charge, the more carefully judges scrutinize gaps.10National Institute of Justice. Law 101 – Legal Guide for the Forensic Expert – Chain of Custody
Long-Term Storage and Retention
Evidence does not disappear after trial. In federal cases, the government must preserve biological evidence for as long as the defendant remains imprisoned when that evidence was secured during the investigation or prosecution of the offense.14Office of the Law Revision Counsel. 18 USC 3600A – Preservation of Biological Evidence Biological evidence includes sexual assault forensic examination kits, blood, saliva, hair, skin tissue, and other biological material. The requirement exists largely to preserve the possibility of future DNA testing.
The government may destroy biological evidence only in limited circumstances: after the conviction is final, after direct appeals are exhausted, after the defendant has been notified and fails to request DNA testing within 180 days, or after the evidence has already been tested and confirmed the defendant as the source. Anyone who knowingly destroys, alters, or tampers with biological evidence that must be preserved, intending to prevent DNA testing, faces up to five years in prison.14Office of the Law Revision Counsel. 18 USC 3600A – Preservation of Biological Evidence
State retention requirements vary. Most states require biological evidence to be kept at least for the duration of incarceration, and some mandate permanent retention for serious offenses like homicide and sexual assault. NIST recommends frozen storage at or below -10°C for long-term preservation of dried biological stains and DNA extracts, with refrigerated storage between 2°C and 8°C as an acceptable alternative for shorter periods.6National Institute of Standards and Technology. The Biological Evidence Preservation Handbook – Best Practices for Evidence Handlers Facilities that fail to maintain these conditions risk degrading evidence that cannot be replaced.
Getting Seized Property Back
If your property was seized during an investigation and is no longer needed as evidence, you can file a motion under Federal Rule of Criminal Procedure 41(g) to get it back. The motion is filed in the federal district where the property was seized. The court hears evidence on disputed facts and, if it grants the motion, orders the property returned, though it may impose conditions to protect the government’s access if the property might be needed in future proceedings.15Office of the Law Revision Counsel. Federal Rules of Criminal Procedure Rule 41 – Search and Seizure State courts have similar procedures, with rules and timelines that vary by jurisdiction. If the property was seized unlawfully in the first place, the motion can also serve as a vehicle for challenging the legality of the search itself.