Evidence, Interviewing & Source Analysis

An investigation is only as strong as the evidence behind it, and evidence has to survive scrutiny, from a regulator, an auditor, or a court. The how of gathering and handling evidence matters as much as the what. The best documentary proof in the world is worthless if you can't show it's authentic and that it wasn't altered.

Imagine a perfect spreadsheet of suspect transfers that the defense shows was edited after collection, suddenly it proves nothing, and your credibility takes the hit. A specialist treats evidence with care from the first moment, labeling, securing, and logging it, because sloppy handling can sink an otherwise airtight case. Under the Federal Rules of Evidence, the side offering proof bears the burden of showing it's what they claim it is.

Let's cover the essentials: chain of custody, the basics of admissibility, effective interviewing, and how to weigh your sources.

Chain of custody is the documented, unbroken trail showing who collected a piece of evidence, when, where it was stored, and everyone who handled it afterward. Its purpose is to prove the evidence presented is the same evidence collected, unaltered. A gap in the chain, an unlabeled exhibit, a missing signature, an hour no one can account for, lets the other side argue the evidence was tampered with or substituted, and a judge may exclude it.

This applies fully to digital evidence, emails, transaction logs, device images, which is fragile and easily questioned, so investigators capture forensic copies and use techniques like hashing, a digital fingerprint, to prove a file hasn't changed since collection. On the exam, when evidence integrity or the question who touched this and when is at stake, chain of custody is your answer.

You don't need to be a lawyer, but you should grasp the basics of admissibility. To be useful in a proceeding, evidence generally must be relevant to a fact in issue, reliable, authentic, and lawfully obtained, the same themes the Federal Rules of Evidence build on. Evidence gathered illegally, say by hacking an account, pretexting, or trespassing, may be excluded entirely, and worse, taint everything it led to, what lawyers call fruit of the poisonous tree.

There are also privilege and work-product considerations: certain communications, like genuine legal advice between a client and counsel, may be protected from disclosure. The practical rule for an investigator is simple, gather lawfully and document carefully, keeping originals secure and noting your methods, so that nothing you find is thrown out on a technicality later. A common exam distractor is evidence that's compelling but obtained the wrong way.

Interviewing is a core investigative skill. Effective interviews are planned, not improvised: you know your objectives and the evidence before you sit down, and you decide in advance which facts to confirm and which to test. You build rapport, because people share more when they're at ease, then move from open questions that let the subject talk, tell me how this account is used, to specific questions that pin down details, who authorized this wire on the third.

A skilled interviewer listens for what's avoided as much as what's said, watches for non-answers, and notices when a story shifts under gentle pressure. Throughout, the interview must stay lawful and ethical, no coercion, no threats, no deception that crosses legal lines, and it must be documented promptly and accurately, because contemporaneous notes carry weight that later recollection does not, and may themselves become evidence.

Finally, source analysis. Not all information deserves equal trust, so investigators separately judge the reliability of the source, has this person or system been accurate before, from the credibility of the specific information, does it fit the other evidence. A reliable source can still pass along a bad tip, and an unreliable source, even a disgruntled insider with an axe to grind, can occasionally be right, so you corroborate before you rely, confirming a key fact through an independent second source rather than acting on a single uncorroborated claim.

This is exactly why the FFIEC manual and good investigative practice prize documentation and independent verification. So, recap: protect evidence with an unbroken chain of custody; gather lawfully so it's admissible; interview with a plan, rapport, and good documentation; and grade your sources for reliability and credibility, corroborating before you act. Next, we cover public records, OSINT, and following the money.

Test yourself first.