🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Agriculture, Environment & Public Service › Crime Scene / Forensic Technician › Digital Evidence Intro › Lesson 8
AGR-CSI53-06 · Lesson 8 · 13 clock hours · practice

Photography and Documentation of Digital Evidence In Situ

Objective. Students will produce a complete photographic and written record of digital evidence at a staged scene that meets the documentation standards required by the IAI CCSI competency area for scene documentation.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by a licensed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Documentation Comes Before Collection

Digital evidence is fragile in two ways: the data inside a device can change the moment the device is touched or powered on, and the physical arrangement of devices at a scene tells its own story. Once you move a tablet or unplug a cable, that story is gone forever. Your photographs, sketch, and written notes together create an unchangeable record that courts, prosecutors, and other technicians can rely on long after the scene is cleared. The IAI CCSI documentation competency requires that every item be captured in three independent formats before anything is disturbed.

The Three-Level Photography Approach

Scene photography follows a structured sequence moving from broad context to fine detail.

Overall (Establishing) Images show the entire room or space. Walk around the room and shoot from each corner and from the doorway. These frames orient a viewer who was never at the scene. Include enough of the room that a person can identify the location of every major piece of furniture.

Mid-Range Images show an item in relation to its immediate surroundings — for example, a desktop computer on a desk with the keyboard, mouse, and external drives in the same frame. Shoot mid-range images from at least two angles. These images link the close-up detail shots back to the overall scene.

Close-Up Images document a single item at full detail. Every close-up must be taken twice: once without a scale and once with an ABFO No. 2 scale card placed flat beside the item so that measurements can be verified later. For digital devices, you need close-ups of:

Do not tap the keyboard, click the mouse, or unplug anything to get a better photo. Document what you find, not what you create.

Screen and Power States

The power state of a device is evidence. A screen displaying open files, a router with all ports active, or an external drive with a flashing activity light may indicate that a process was running at the time of the scene. Write down in your notes exactly what you see: screen content if visible, colors of indicator lights, and which cables are plugged in versus which ports are empty. Photograph before you do anything else. If a device is powered on and you have not yet consulted with a digital forensic examiner, leave it on. If a device is off, leave it off. These decisions belong to established department protocol and examiner guidance, not to the documentation technician working alone.

The Scaled Sketch

Your sketch is a top-down, bird's-eye drawing of the space, drawn to a consistent scale on graph paper (for example, one square equals one foot). Measure the room dimensions and the location of each item from two fixed reference points — usually two adjacent walls. Label each device with its assigned evidence number using a consistent numbering scheme (E-001, E-002, and so on). The sketch must show:

A rough sketch is made at the scene; a finished sketch can be produced later using the measurements recorded on the rough version.

Narrative Notes

Your written narrative describes the scene in plain language detailed enough for another technician who was never present to reconstruct it. Write in the past tense and first person. Include:

Never speculate about meaning in your notes. Record what you observe, not what you conclude.

The Photo Log

Every frame you shoot gets an entry in the photo log. The log is a legal record that ties each image to its context. Each row must include: frame number (or file name), time the photo was taken, direction of view (N, S, E, W, or toward subject description), brief description of what is shown, and the photographer's name. When the log is complete, cross-reference it against your sketch and notes. Every evidence item listed in your notes should appear in the sketch and in at least one overall, one mid-range, and two close-up frames in the log. Any gap is a documentation failure.

Safety Considerations

Before entering the scene, confirm with the lead investigator that the space has been cleared and is safe to enter. Wear appropriate PPE as directed (nitrile gloves at minimum to avoid leaving latent prints on device surfaces and to protect against biological hazards on shared surfaces). Do not handle any cables or devices until documentation is complete. Be aware that live electronic equipment can present electrical hazards — do not place scale cards or any item on top of a powered device in a way that could block ventilation or cause a hazard. Follow your agency's or program's protocols for working near powered equipment.

Connecting to Your Credentials

IAI CCSI candidates are evaluated on scene documentation as a core competency. Courts scrutinize photographic records to confirm that evidence was properly identified and that nothing was altered before collection. A complete, consistent set of photos, a scaled sketch, narrative notes, and a cross-referenced photo log are the foundation of every successful digital evidence case.

Key terms8

Three-level photographyA structured sequence of overall, mid-range, and close-up images that documents a scene from broad context down to item-specific detail.
ABFO No. 2 scale cardA standardized photographic scale card used in forensic photography to provide a size reference in close-up images so measurements can be verified later.
Power stateThe operational condition of a digital device at the time it is discovered — on, off, sleeping, or in an active process — which is itself potential evidence.
Photo logA written record listing the frame number or file name, time, direction of view, description, and photographer name for every image taken at a scene.
Scaled sketchA top-down diagram of a scene drawn to a consistent scale, showing room dimensions and the measured position of each item of evidence.
Evidence numberA unique identifier assigned to each item of evidence (e.g., E-001) used consistently across photographs, the sketch, and written notes.
Indicator lightAn LED or lamp on a digital device that signals power, network, storage activity, or other operational status — the color and behavior of which must be documented.
Cross-referencingThe process of comparing the photo log, sketch, and narrative notes to confirm that every evidence item appears in all three documentation formats with no gaps.
In class: Staged scene photography: students photograph a mock home-office scene containing a desktop, two external drives, a tablet, and a router using the three-level approach (overall, mid-range, close-up with scale) and document screen states, indicator lights, and cable connections. · Sketch and notes drill: students produce a hand-drawn scaled sketch of device placement on the desk and in the room, label each item with an evidence number, and write a narrative description that would allow another technician to reconstruct the scene. · Photo log completion: students create a photo log listing frame number, direction of view, description, time, and photographer name for every image taken, then cross-reference the log to their sketch and notes to verify every item appears in all three documentation formats.
Materials: DSLR cameras, ABFO No. 2 scale cards, photo log forms, graph paper, pencils, rulers, evidence number placards, sanitized training devices as scene props, IAI scene documentation standards reference
Check: Photo set, sketch, notes, and photo log evaluated on a 25-point rubric aligned to IAI CCSI documentation competencies; pass = 20/25 or higher, with no critical omissions (defined as a device not appearing in any documentation format).

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Scene Documentation
1. A student finishes shooting close-up images of a router but forgets to include a scale card in any of those frames. Which IAI CCSI documentation requirement has been violated?
Scene Documentation
2. At a mock scene, a technician finds a laptop with its screen displaying an open document. What is the correct first action?
Scene Documentation
3. Which sequence correctly follows the three-level photography approach when documenting a desktop computer?
Scene Documentation
4. A student's photo log shows 48 frames. When cross-referencing the log against the sketch, the student discovers that E-004, an external hard drive, does not appear in any log entry. Under the rubric used in this course, this error is classified as:
Scene Documentation
5. Why must a forensic technician document cable connections — including both ends of each cable — during digital evidence scene photography?
Scene Documentation
6. On a scaled sketch, a student marks the desk as 6 squares wide using a scale of 1 square = 1 foot. A classmate who reviews the sketch measures the actual desk prop and finds it is 5 feet wide. What is the most likely cause of this discrepancy?
Scene Documentation
7. A technician is writing narrative notes and observes that an external drive labeled E-003 has a solid blue indicator light and is connected by a USB cable to the desktop labeled E-001. Which entry most accurately captures this in the notes?
Safety and Scene Integrity
8. Before entering a staged scene containing powered electronic devices, which minimum PPE requirement applies specifically to avoid leaving latent prints on device surfaces?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →