Appendix B: Evidence Collection and the Chain of Custody

The case is usually won or lost at the scene, and the damage done there cannot be undone. A contaminated sample can sometimes be flagged; a scene processed wrong is simply gone — the original arrangement of the world at the moment that mattered, paved over by everyone who walked through it. No instrument in any laboratory, however sensitive, can recover what was lost in the first thirty minutes on the ground. This appendix distills the scene-work chapters (Chapters 2 and 3) into a single practical reference: how to secure and document a scene, how to search it, how to recognize evidence, how to collect and package each type without destroying it, how to build an unbroken chain of custody, and the short, memorizable list of errors that wreck cases most often. It is written to be used — at a scene, in a classroom, or while reading a case file with a critical eye.

Two principles govern everything that follows, and they are worth fixing first. Document before you disturb: every irreversible act is preceded by a reversible record. And match the package to the threat: there is no universal correct container — ask what destroys this particular kind of evidence (heat, moisture, microbes, evaporation, light, time) and package to defeat that specific enemy.

B.1 First response: securing and not destroying the scene

A crime scene is any location where a crime may have occurred and where physical evidence may be found. Note the two mays: at the moment the first officer arrives, no one knows for certain that a crime occurred or where the boundaries of the relevant evidence lie. A scene is a working hypothesis about where the relevant past is still legible, and the first responder's job is to protect that legibility before anyone has decided what the scene even is.

The first responder's priorities run in a strict order, harsh precisely because it is correct (Chapter 2, §2.1):

1. Safety first — their own and everyone's. A scene with a live shooter, an unstable structure, a gas leak, downed wires, or fire is a danger before it is a puzzle. Processing waits until the scene is safe.
2. Preserve life. If a victim may be alive, rendering aid outranks every evidentiary concern. The rule is not "don't disturb the scene"; it is disturb it only as much as saving the person requires, and remember exactly what you did. A paramedic who later says "I moved the body to start CPR; the arm was here, I put it there; I cut the shirt up the front" has converted an unavoidable disturbance into documented information.
3. Detain or note witnesses and suspects. People leave; memories decay and contaminate each other. Separate witnesses so they cannot rehearse a shared story, and note who was present.
4. Secure the scene — the duty most often shortchanged.

That fourth duty has a name. Scene security is the set of actions that restrict access so that evidence is neither lost, added, moved, nor contaminated before it can be documented and collected: establishing a perimeter, controlling who crosses it, and — the part everyone forgets — keeping a record of everyone who does. Draw the perimeter generously. It is trivial to shrink one later; it is impossible to recover evidence outside a perimeter drawn too small, because the public, the press, and the responders' own boots have already been all over it. The path the perpetrator took to and from the scene — often the richest evidence of all — extends well beyond the body.

🔬 At the Bench The single most useful piece of paper at any scene is the crime-scene log (entry/exit log): a record of every person who crosses the perimeter, with time in, time out, and reason for being there. It seems bureaucratic; it is the backbone of the case's integrity. When a defense attorney later asks "who had access to this scene, and could any of them have moved or added this item?", the log is the only honest answer. Keep it from the first responder forward, not from the moment detectives decide it "became serious" — by then the most important visitors have already come and gone unrecorded.

The deepest principle of first response is negative, and it runs against every human instinct at a scene of violence or disaster: do as little as possible. The untrained impulse is to help — cover the body, open a window for the smell, pick up the gun "so no one gets hurt," turn off the running faucet, let the grieving family back inside. Every one of those kindnesses destroys information. The discipline is to convert the impulse to act into the impulse to record: not "I will fix this," but "I will note exactly how I found this, and change it only when a life or safety requires it." The scene as first encountered is a one-time recording. It plays once.

🧠 Cognitive-Bias Watch The moment a scene is labeled "accident" — a fire, a fall, a sudden death — the discipline of preservation relaxes. Why log every entry, why photograph the doorframe, why treat the place as a crime scene, if no crime occurred? The early frame shapes the care taken, and care not taken at the scene cannot be taken later. The safest practice is to treat ambiguous scenes as if they were crime scenes until the evidence earns the downgrade, not the other way around (Chapter 2, §2.1; Chapter 31).

B.2 Documenting the scene: notes, photography, sketch

Once a scene is safe and secured, the first real work is not collection. It is documentation — the systematic creation of a permanent, objective record of the scene as found, before anything is touched. Documentation is what makes collection mean anything, because the act of collecting evidence destroys the scene that produced it. The instant you lift the gas can to bag it, the scene no longer shows where it was — only the documentation does. Poor documentation turns evidence into an orphan: a real object with no provable home in the world.

The non-negotiable rule of sequence: document before you disturb. Photograph it before you measure it; measure it before you collect it; collect it before you let anyone walk where it was.

Scenes are documented three independent ways, and the redundancy is rigor, not waste — each method covers the others' blind spots (Chapter 2, §2.2):

• Notes. Contemporaneous, written at the time, in ink, dated and timed, with errors struck through by a single initialed line rather than erased (erasure looks like concealment on a courtroom screen). Good notes record arrival time, weather and lighting, who was present and when, the condition of the scene (doors locked or open, lights on or off, heat or cooling running), the location and apparent nature of each item, and every action the investigator takes and when. Notes capture what photographs cannot: smells, temperatures, the sound of a running appliance, the sequence of events over time. Write as if every note will one day be read aloud by a hostile attorney — because it may be.
• Photography, proceeding from general to specific: overall (establishing) shots of whole rooms and their relationships; mid-range shots fixing an item among nearby reference points; and close-ups of each item's detail, taken twice — once as found, once with a scale in the frame so true size can be recovered. A close-up of a bloodstain or tool mark without a scale is a picture of a shape with no dimensions. Two honest limits: a photograph flattens three dimensions and can lie about distance, angle, and size (which is why the scale, the mid-range shot, and the sketch anchor it); and "enhancement" is mostly fantasy — software cannot conjure detail a sensor never captured (Chapter 26).
• Sketch. A labeled diagram with measured distances, fixing each item by at least two measurements to fixed reference points (triangulation or baseline) so its position can be reconstructed exactly even after the object and the building are gone. North is marked; a legend identifies each numbered item; the sketcher's name and date are on it. A rough sketch is drawn by hand at the scene carrying the real measurements; a finished sketch may be drafted to scale later. Where the photograph shows appearance, the sketch records spatial relationships a photograph distorts.

The three records are deliberately redundant: when all three agree, the scene's account is hard to attack; when one is missing, the defense has found its opening. One more device: the initial walkthrough — a single, careful, hands-in-pockets pass along a planned path before documentation begins in earnest, to grasp the scene's extent, spot fragile evidence, and plan the work. Observation only; nothing is touched.

B.3 Search patterns and the recognition problem

A documented scene must be searched, and the hard part is not looking — it is recognition, perceiving that an ordinary object is, in this context, evidence. A cigarette butt in an ashtray is trash; the same butt on the floor of a remote cabin where the dead man did not smoke is a potential DNA source and a potential placer of a person at the scene. Evidence does not glow. You cannot collect what you do not recognize, and recognition depends on knowledge, attention, and freedom from premature theories about what the scene "is." The investigator who has already decided a fire was an accident will not see the doorframe blood as evidence — and so will not collect it, and so it will not exist for the lab.

To make recognition systematic rather than lucky, scenes are searched by a deliberate search pattern — a planned, geometric method of total, non-overlapping coverage. Choose the pattern to fit the scene (Chapter 2, §2.3):

What matters far more than which pattern is that some deliberate pattern is used and recorded, so the team — and later the court — can say the whole scene was covered and nothing was searched twice on a hunch while a corner went unexamined. Two practical points: stage the search by fragility — the most perishable (transient) evidence is documented and collected first; and a thorough scene is often searched more than once, by fresh eyes, because attention fatigues and the second searcher sees what the first stopped seeing.

🧠 Cognitive-Bias Watch A search is where expectation does its quietest damage. A searcher looking for a gun tends to find guns and overlook the unspectacular fiber, the faint shoe impression, the stray cartridge case that does not fit the expected story. Recognition and bias are two sides of one coin: you tend to recognize what you are looking for, which means the theory you carry into the scene silently edits the evidence that comes out of it. Search the whole scene to the same standard regardless of what you expect to find (Chapter 2, §2.3).

B.4 Recognizing evidence: the five working categories

Category determines handling, and category determines what an item can prove. Practitioners sort physical evidence into five overlapping working categories (Chapter 3, §3.2). They are not airtight boxes — a single bloodstain can be transfer, pattern, and associative evidence at once — but they train you to ask the right questions.

• Transient evidence — temporary by nature; it changes or disappears if not recorded immediately (an odor of gasoline or bleach, the warmth of a car hood, a wet-versus-dry stain, a dying statement). It usually cannot be collected at all, only documented — and the documentation becomes the evidence. If no one records it in the first minutes, it never existed as far as the case is concerned.
• Conditional evidence — produced by an event and dependent on the conditions at a moment (a light on or off, a door locked or unlocked, a body's position, the state of a fire on arrival). It does not evaporate, but it is destroyed the instant anyone changes the conditions. Usually preserved by documentation, not collection.
• Pattern evidence — the arrangement carries the information (a bloodstain pattern, a fingerprint's ridges, a shoe or tire impression, glass-fracture direction, tool marks). Preserved overwhelmingly by photography with a scale, because the geometry is the evidence and the object often cannot be removed. This is also where much of the field's worst overreach lives — reading a pattern is interpretive and examiner-dependent.
• Transfer evidence — material moved by contact (hairs, fibers, glass, soil, paint, GSR, skin cells, transferred blood); Locard's principle made tangible. Its value depends on how rare the material is and how well the transfer persisted. Collected by picking, taping, scraping, swabbing, or seizing whole — and exquisitely vulnerable to contamination.
• Associative evidence — defined by what it does: it tends to associate a person, object, or place with the crime (a dropped wallet, a traced weapon, a DNA profile matching a suspect). The name is a built-in reminder of the central honest question: associate is not the same as identify, and certainly not the same as prove.

B.5 Collection and packaging — and why plastic bags ruin biological evidence

Now, and only now — documented, sketched, photographed, searched — does evidence get collected. A few rules are simple to state and constantly violated under pressure (Chapter 2, §2.4; Chapter 3, §3.6):

• Avoid contamination. The collector's body, breath, and tools are themselves sources of foreign material — most dangerously, foreign DNA. Wear gloves and change them between items (one pair across five items can carry material from the first to the fifth — cross-contamination). Wear masks and hair covers; use clean or disposable tools and clean them between items; avoid talking, coughing, or sneezing over evidence.
• Collect a reference, and collect a control. When a stain is swabbed, also swab an unstained area of the same surface — a substrate control — so the lab can distinguish what was in the stain from what was in the surface or the swab itself. Known/reference samples (from verified sources) and elimination samples (from people with legitimate access) must be collected at the time, because they cannot be collected later. Evidence collected without its controls is evidence the lab cannot fully interpret.
• Package each item separately, label it, and seal it. Every item in its own container so items cannot rub and transfer trace. Label each — what, where, when, by whom, case number — and seal it so tampering shows: close it, tape over the opening, and write initials and date across the tape and onto the container, so it cannot be opened and re-closed without the break being visible.

And the rule the field lives by, the one that separates investigators who understand biology from those who merely follow checklists:

🔬 At the Bench Biological evidence — blood, semen, saliva, tissue, anything once alive and wet — must never be sealed wet in airtight plastic. The reason is microbial and unforgiving: plastic traps moisture; moisture is the medium in which bacteria and fungi thrive; and bacteria and fungi digest DNA. Sealed wet in plastic, a bloodstain becomes a warm, humid incubator, and over days the very molecule the lab needs is consumed by mold. The correct handling is built around one word: dry. Air-dry a wet swab or damp garment out of direct sunlight and away from heat (both also damage DNA), then package in a breathable container — paper bag, paper bindle, cardboard box, envelope. The mnemonic: "paper for biology, plastic for the rest." The contrast that makes it click: inert trace like glass or paint chips is often best kept in sealed plastic precisely because it is airtight and won't let fragments escape — the same property that makes plastic right for an inert chip makes it lethal for a living cell.

The packaging table every scene team carries in its head:

The governing idea is always the same: ask what destroys this kind of evidence and package to defeat that. Get it backward — biology in plastic, fire debris in paper — and the packaging itself destroys the result. Beyond the container, some evidence needs the cold: biological samples that cannot be processed promptly are refrigerated or frozen to slow microbial and enzymatic breakdown.

🔬 Read the Evidence

text FIGURE B.1 — "Two swabs, two containers, two fates" [constructed teaching example] THE ITEM Two swabs of the same wet bloodstain, taken at the same scene by the same investigator, split into two packages. THE CONTEXT Swab A is air-dried at the scene and sealed in a paper envelope, initialed across the seal. Swab B is sealed wet in a zip-top plastic bag "to keep it from leaking." Both are logged and sent to the state lab; transit and storage take nine days in a warm vehicle and a warm property room. WHAT IT SHOWS On arrival, Swab A yields a clean, full DNA profile. Swab B is visibly moldy; the lab recovers only a partial, degraded profile, or none. WHAT IT DOESN'T The failure of Swab B says nothing about the suspect, the crime, or the truth of the case. It is not exculpatory and not inculpatory — it is simply destroyed. This is DEGRADATION, not contamination; the plastic added no one's DNA. THE INFERENCE The difference in outcome is caused entirely by the container and the moisture, not by anything about the blood. Identical evidence, opposite fates. THE LESSON Packaging is not clerical. For biological evidence it is the difference between a usable sample and a ruined one — paper for biology, and dry it first.

B.6 Known, reference, and control samples

A questioned item, by itself, usually means nothing. It acquires meaning only by comparison — and the comparison samples must be collected at the scene, because they cannot be collected later. Keep three terms rigorously distinct (Chapter 3, §3.3):

• A questioned sample (unknown / evidence sample) is recovered from the scene or a person and its source is in question — the bloodstain of unknown origin, the latent print, the fiber, the white powder.
• A known sample (reference sample) is material from a verified, documented source, collected so the questioned sample can be compared against it — a buccal (cheek) swab from the victim and each suspect; reference fibers from a suspect's sweater. Its defining feature is that you are certain where it came from. Comparison evidence is meaningless without the right knowns.
• A control sample establishes a baseline and proves a result is real rather than an artifact of the substrate, the reagents, or the collection itself.

The control family worth knowing (and worth asking, on cross, which were run):

• Substrate / background control — unstained material from the same surface, to show the surface is not the source of the signal.
• Reagent / negative control — the test with no sample, to show the reagents are not contaminated or false-positive on their own.
• Positive control — the test on a sample known to contain the target, to show the test works and would have detected the target if present (a negative result is only meaningful if you have shown the test can go positive).
• Elimination samples — references from people with legitimate access (homeowner, responding officers, lab staff), so their DNA, prints, or fibers can be recognized and set aside rather than mistaken for a suspect's.

A result reported without its controls is not wrong, exactly — it is unverifiable, which in forensic terms is nearly as bad. Reference samples must also be representative and documented: one fiber from one corner of a multicolored garment may not represent the part that contacted the victim, and a reference sample whose own provenance is uncertain has quietly become a second questioned sample.

B.7 The chain of custody: the unbroken trail

An item of evidence is only as good as the story of where it has been. Suppose the lab reports a clean DNA profile from a gas-can handle consistent with a suspect. The defense's first question is not about biology; it is: How do I know this is the swab from that gas can, taken at that scene, untouched between the cabin and the analyzer? The answer is the chain of custody — the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of an item, recording every person who handled it and every transfer from one person's control to another's, from collection to its presentation in court (Chapter 2, §2.5).

At heart it is a written answer to one question asked of every item: who has had this, and could any of them have changed it? Each link is a documented transfer — collector to evidence technician, technician to courier, courier to lab, analyst to storage — signed and dated by both the person relinquishing the item and the person receiving it.

FIGURE B.2 — A chain-of-custody trail (illustrative)

  SCENE                 TRANSPORT            LAB INTAKE           ANALYSIS         STORAGE
  ┌──────────┐  sign→   ┌──────────┐  sign→  ┌──────────┐  sign→  ┌────────┐ sign→ ┌────────┐
  │ collected│ ─────────│ courier  │─────────│ evidence │─────────│ analyst│───────│ secured│
  │ by CSI   │  ←sign   │          │  ←sign  │ clerk    │  ←sign  │        │ ←sign │ vault  │
  └──────────┘          └──────────┘         └──────────┘         └────────┘       └────────┘
   sealed,               seal intact          seal logged,         seal broken      resealed,
   initialed             on receipt           ID/condition         to test,         initialed
   across tape                                checked              re-sealed after

  Each ──── is a TRANSFER: signed and dated by BOTH the releaser and the receiver.
  An undocumented gap anywhere on this line is a "break in the chain."

Two honest clarifications, because the chain is widely misunderstood (Chapter 2, §2.5):

• What an unbroken chain proves: integrity and identity — this is the right item, and it was not tampered with in any undocumented way. That is a necessary foundation for trusting the analysis.
• What it does not prove: nothing about whether the evidence was collected correctly, whether the scene was contaminated before collection, or whether the analysis was sound. An immaculately documented swab already cross-contaminated by a careless glove at the scene has a flawless chain and a worthless result. The chain protects the item from the moment it is bagged; it cannot protect it from what happened before. Do not let an unbroken chain launder a badly collected sample — the chain is about custody, not quality.

⚖️ In the Courtroom Defense attorneys probe the chain not usually to prove tampering occurred — that is rare — but to show it could have, because a documented possibility of mix-up is enough to seed reasonable doubt. A missing signature, a swab logged in two hours after it was logged out with no account of those hours, a seal that arrived already broken — none proves the evidence false, but each opens a door. Courts vary: a minor, well-explained gap may go to the weight the jury gives the evidence, while a serious, unexplained break can get it excluded entirely. Either way, the chain is built link by link by the first responder and collector, and a link skipped in the first hour cannot be forged honestly in the courtroom years later.

🧠 Cognitive-Bias Watch There is a subtle integrity threat the chain does not catch: it records who handled an item, but not what they were told about it. An analyst can receive a perfectly documented swab accompanied by a note reading "suspect's DNA — please confirm," and that note — entirely outside the chain — can bias interpretation (Chapter 31). The chain protects the object's body; it does not protect the analyst's mind. Closing that gap, by keeping domain-irrelevant information away from the analyst, is one of the field's most important unfinished reforms.

B.8 The most common scene errors

Almost everything that ruins a case at the scene comes down to a short list. Memorize it as a checklist of what not to do — each is irreversible, which is the recurring horror of scene work (Chapter 2, §2.7):

1. Failure to secure, and to secure widely enough. Perimeter set too small or too late; the public, press, colleagues, and family walk through before it is protected. The most common single error and the parent of many others.
2. No entry/exit log. Without a record of who was present, every item is challengeable, because no one can say who had access. The absence hands the defense a universal objection.
3. Disturbing before documenting. An item is moved, collected, or "tidied" before it is photographed and sketched in place — its original location gone forever. Includes the well-meaning kindnesses of first response.
4. Contamination by responders. Bare hands, unchanged gloves, breath, coughs, dropped hair, tools carried item to item — transferring foreign material and creating false associations, or destroying real ones. More dangerous as DNA methods grow more sensitive, not less.
5. Wrong packaging — biology in plastic. Wet biological evidence sealed in airtight plastic, where mold consumes the DNA before the lab opens the bag. The evidence is destroyed by procedure, not by the crime.
6. Tunnel vision at the scene. The scene is processed to fit an early theory — accidental fire, suicide, the obvious suspect — so the search collects what confirms it and overlooks what contradicts it. This is the error that quietly produces the others: a scene believed to hold no crime is a scene no one bothers to secure, log, document, or search to standard.
7. Breaks in the chain of custody. A missing signature, an unexplained time gap, a broken seal — any undocumented interval opens a tampering or mix-up argument, even when none occurred.
8. Incomplete documentation. A scale left out of a photo, a sketch never drawn, notes reconstructed from memory that evening, a missing substrate control. None feels catastrophic at the scene; each becomes a hole the moment the case is contested.

What unifies the list is the whole argument of scene work: errors here are irreversible and upstream of everything. The most rigorous DNA method, the most careful courtroom testimony — all of it is capped by the quality of the scene work that fed it. A brilliant analysis of a contaminated sample is brilliantly worthless. This is why the field's reformers treat scene processing not as the unglamorous prelude to "real" forensic science but as its actual foundation: the place where evidence is either preserved honestly or lost forever, in the first cold hour, before anyone knows what the case will turn out to be.

B.9 A field checklist

For quick reference, the scene sequence in order. Each step assumes the one before it is complete.

1. Approach and assess. Safety first. Note conditions on arrival (weather, lighting, what is burning, what is running) before they change.
2. Preserve life; record any disturbance. Aid the living; note exactly what was moved, by whom, and why.
3. Secure a generous perimeter; start the entry/exit log — from the first responder forward.
4. Initial walkthrough — hands in pockets, planned path, observation only; identify fragile evidence and plan the search.
5. Document before disturbing — notes (contemporaneous, in ink), photographs (overall → mid-range → close-up, twice with a scale), measured sketch (two reference points per item, north marked).
6. Search by a deliberate, recorded pattern — transient and fragile evidence first.
7. Collect — gloves changed between items; clean tools; collect each questioned item with its substrate control and the needed knowns/elimination samples.
8. Package by the threat — paper (dried) for biology; airtight cans for fire debris; sealed plastic for inert trace; each item separately, labeled, and sealed across the tape with initials and date.
9. Build the chain of custody — every transfer signed and dated by both parties; seals intact and verified at each handoff.
10. Preserve in transit and storage — refrigerate or freeze biological evidence not processed promptly; keep volatiles airtight.

Work the list in order, document at every step, and remember the two governing principles: document before you disturb, and match the package to the threat. (Appendix I's chain-of-custody template and evidence log are where a working case file keeps this record.)