Investigative Techniques

Investigative Techniques

There are many ways to conduct an investigation and gather evidence.

The following is a basic, non-comprehensive list of common evidence-gathering techniques and some of the benefits and challenges associated with them.

You can solicit information from the people • Ensure preservation of the subject's rights. Comply with all involved with or who have insight into an incident. However, applicable laws regarding interviews. for all organizations other than law Make sure the subject is aware that they enforcement entities, this can pose do not have to partake in the interview some legal challenges in many jurisdictions. (even when the choice to refuse an Some aspects that should interview will result in termination be considered when conducting interviews of employment). If required by law or of personnel: contract, allow the subject to bring an attorney or union representative

• Enlist trained interviewers. Not all

to the interview.

security professionals are familiar with interview procedures and best practices. If • Record when possible. In some necessary, use an experienced contractor jurisdictions, recording interviews can for this purpose. be problematic; check your local applicable laws. Be sure to notify the

• Conduct multi-party interviews.

interview subject that the conversation is

Never have a sole interviewer talk being recorded (record the notification).

to the subject.

• External requests

Investigators can request information from external sources to collect evidence relevant to the situation. External sources might include intermediary communications entities (ISPs), government agencies, interested parties, witnesses, and so on. Requests can be formal (in the form of subpoenas) or informal (that may or may not be fulfilled, on the decision of the party receiving the request).

Manual capture

The investigator can make copies of evidence where necessary, and record specific information (including audio interviews, photographic/video capture of the incident scene and response process, and so forth) for later usage.

Automated capture

The organization's monitoring activity can be used for collecting and analyzing incident data in addition to the goals of detection and performance optimization; this is especially true if the organization has a continuous monitoring program in place. Normal logging can be copied and harvested for evidential purposes.