Official Syllabus Focus
- Principles
- Preliminary investigation
- Intelligence operations
- Database investigation
- Electronic investigation
- Forensic investigation
Introduction and Scope
What this topic covers: Criminal investigation is the lawful, systematic process of discovering facts, identifying suspects and collecting admissible evidence.
What this topic covers: A good investigation preserves the scene, develops leads, records actions, maintains chain of custody and tests hypotheses against evidence. Modern investigation uses databases, digital evidence and forensic science alongside interviews and field work.
The logic of investigation
Criminal investigation is a structured process for identifying what happened, who was involved and what reliable evidence can establish. It begins with scene protection and initial information, develops hypotheses, gathers and tests evidence, documents decisions and prepares material for lawful prosecution or closure.
Good investigation is hypothesis-testing rather than suspect-confirmation. Investigators should actively look for material that supports or contradicts an early theory because confirmation bias can cause serious error.
Intelligence, databases and digital inquiry
Intelligence analysis combines information from lawful sources to identify patterns, associations and risks. Databases can link fingerprints, vehicles, communications, financial records or prior incidents, but a database match is a lead whose reliability and legal admissibility must still be established.
Electronic investigation involves preservation, acquisition and analysis of digital evidence while maintaining integrity and chain of custody. Volatile data, metadata and cloud-based records require timely legal process and technically sound handling.
Forensic investigation and chain of custody
Forensic science applies specialized methods to physical or digital material. The value of a laboratory result depends not only on the test but also on lawful collection, contamination control, documentation, validated methods and interpretation.
Chain of custody records who collected, transferred, stored, examined and produced an item. Its purpose is to support the claim that the evidence presented is the same material obtained during investigation and has not been materially altered.
Concept Flow
Scene & initial information → Hypotheses → Evidence collection → Testing/corroboration → Documentation → Case review/prosecution
Core Concepts Explained
- Investigation should begin with preservation of the scene and objective documentation before investigators become committed to a single theory of the case.
- Physical, testimonial, digital and documentary evidence must be collected, labelled, preserved and linked through a reliable chain of custody. Poor handling can make strong evidence unreliable or inadmissible.
- Intelligence and database searches generate leads; electronic and forensic methods test or connect those leads; interviews supply human accounts that must be corroborated.
- Good investigation is hypothesis-testing: investigators should look for evidence that supports and evidence that challenges their working explanation, reducing tunnel vision and wrongful accusation.
| Common confusion to avoid: Do not treat confession as the goal of investigation. The goal is a lawful, reliable and corroborated evidentiary case. |
|---|
Preparation and Answer Use
- Learn sequence: scene security → documentation → collection → analysis → leads → case file.
- Always connect technique with legality and evidence integrity.
Key Takeaways
Key takeaway: Investigation should be evidence-led, documented and lawful.
Key takeaway: Chain of custody protects evidentiary reliability.
Key takeaway: Forensics supports but does not replace investigative reasoning.