Identifying Evidence in the Forensic Chain of Custody

Evidence labeling best practices

When recovering evidence, the primary goal is to properly label the items for easy identification at a later date¹. All collected evidence should be tagged at the time of collection. Each label should contain the same information, typically: description of the item, case number, date and time, location, collector’s name, and serial number if applicable. It is also highly advisable to use printed data where possible, as handwriting can smear and fade over time. Thermal printers that offer resistance to moisture are preferred to inkjet printers, especially for evidence stored indefinitely. Hazardous biological evidence packages must also be appropriately labeled with biohazard labels and signage. Additionally, the packaging can also be used to record the chain of custody.

Furthermore, providing an accurate and complete custody record chain is critical to ensuring the accuracy of the information gathered from the subsequent testing. It also establishes proof that the items of evidence collected at the crime scene are the same evidence presented in a court of law. A proper forensic chain of custody record identifies and tracks the evidence from collection, testing, and final disposal, recording each individual who had possession and was responsible for the item. Any forensic labeling information included should, therefore, be traceable and contain a unique identifier. Using barcodes for this purpose is ideal, as this allows the package to be scanned before any manipulation for improved tracking and meets the criteria for a unique identifier.

The use of evidence tracking and management software is also recommended to identify and track samples rapidly¹. The increase in the volume of evidence and the increasing need for efficiency in tracking has made property room and laboratory management software an integral part of any improved evidence processing system. Property room management software coordinates the intake and storage of evidence, though an added flagging system is required to indicate evidence that has not been returned by a predetermined time. Laboratory information management systems (LIMS) are used in most labs to track samples and inventory, manage workflows, and record lab work. This would also aid forensics labs to run more efficiently and improve overall productivity.

Proper storage conditions

The packaging and storage of evidence are important for any forensic investigation. Evidence is typically received in two forms, wet or dry. Wet evidence will usually need to be dried prior to storage, though temporary storage of wet evidence may also be required. When handling dry evidence, it should be placed in an unused breathable container, securely sealed, and labeled with information essential to efficient evidence processing, filing, and retrieving. The evidence bags or boxes should be placed on properly fitted shelves, ensuring that all packages remain visible and eliminating the possibility of something hidden behind other evidence.

While DNA in biological samples is generally quite stable and can tolerate room temperature storage conditions, it is recommended that all biological evidence be kept in cold storage¹. This includes short-term storage in refrigerators, with some blood samples stable for more extended periods if certain preservatives are added. As such, containers need cryogenic storage labels that will stay adherent under cold temperatures, as if the label falls off, the specimen would need to be relabeled and retested for ethical concerns. Specific biological evidence may require being frozen in freezers, further necessitating the need for cryogenic labels that will withstand those conditions.

The importance of tamper-evident labels

Another aspect of the forensic chain of custody that needs to be adequately addressed is the possibility of evidence tampering. All packaged evidence must be securely sealed to guard against potential loss or contamination and the threat of harmful change. As such, the seal must be made so that opening the package causes obvious damage or alteration to the container or its seal. Each individual who interacts with the package must also be able to attest to the package’s condition when they received it (e.g., sealed/not sealed or damaged) and is required to reseal it after handling if opened. This can be achieved through the use of tamper-evident and destructible labels or tape, augmented with the sealer’s initials and the date. The implementation of sequentially numbered tamper-evident labels can make it virtually impossible to tamper with evidence in a manner that goes unnoticed. This makes the use of tamper-evident tags an integral part of any effective and reliable forensic labeling chain-of-custody system.

Lab automation & digital forensics

Recently, forensics labs have started adopting automation to help process the high volume of samples they receive daily. Automation will also help identify vials, either in-process or in storage, currently the biggest system failure present in forensic labs. This is partly due to the high use of difficult to handle 0.2 ml PCR tubes. Properly identifying individual PCR tubes with a unique identifier is often required due to the proliferation of biological data currently in the field. The NIST suggests that each label include all information relevant to the case, which can be difficult to inscribe by hand. Automated print-and-apply systems, along with automation labels, can automate this process, labeling 0.2 ml PCR tubes to 50 ml Falcon tubes with 2D barcodes and multiple lines of human-readable text.

Another example of an automatic labeling system that can help record keeping, and supports the chain of custody, is radio frequency identification (RFID) technology. Barcodes are already used to improve evidence tracking in many agencies, with RFID being explored as a further upgrade. This would allow automated alerts to be sent to managers when highly sensitive evidence is moved, if there is a drop in storage temperatures, and to maintain photographs of evidence. RFID would provide real-time tracking information, and since it can read multiple tags simultaneously, it can monitor the entire evidence inventory at the same time.

Technology is also changing forensics, with the newly created digital forensics field. It is defined as the preservation, identification, extraction, and documentation of computer evidence, which the court of law can use. It provides the forensic team with tools to solve complicated digital-related cases. Digital forensics helps capture important information in cases where computer systems or networks are compromised and serves to preserve the integrity of digital systems, where possible.

Disposal of evidence

An area that is often overlooked but also important is the disposal of evidence once a case or file is closed. A specific evidence disposition process should be part of every agency’s procedures. Disposition may entail retention and disposal, return, or destruction, including determining that the legal process is concluded and any further case investigation is completed. For biological evidence, each agency must also safeguard that material is safely disposed of according to local regulations. This includes disposing of any labels or tags that contain sensitive or confidential information. In cases where representative samples must be retained for possible future analysis, these samples will need to be appropriately identified and cataloged.