A Beginner's Primer on the Investigation of Forensic Evidence
By KIM KRUGLICK
Sponsor of The Forensic Resource and Criminal Law Search Site
265 Miller Avenue
Mill Valley, CA 94941
TABLE OF CONTENTS
Part I: Introduction
But it's in the report...
General laboratory issues
Let's talk money here for a second
More about labs generally
A moment on discovery
So now what do I do with all this @#%$ stuff?
Technician specific issues
Case Specific Issues
Discoverable Material Checklist
Forensic Case Issue Checklist
PART I: INTRODUCTION
BUT IT'S IN THE REPORT...
Your client looks at you across your desk, his eyes glistening with as much sincerity as you've ever seen, and says plaintively, almost silently, "I know what the lab report says, but I swear, it's not my _______." (Fill in the blank with any one or more of the following as appropriate): blood, gun, fingerprints, DNA, tool mark, semen, hair, fiber, handwriting, shoe impression, or tooth mark.
The guy seems totally believable, but you too have read the lab report and so you know, I mean like, really know, it is indeed his blood, or hair, or whatever...says so right in the crime lab report's section on "Results". It's enough to make you think to yourself; "This guy would make a great witness. Even I can't tell he's lying".
Well, not so fast! There is an ever increasing possibility that your client really is telling you the truth and what you're confronted with is an error that occurred somewhere between the collection of the evidence and the writing of a report of the laboratory's findings.
Few areas of examination at trial can seem as daunting as the prospect of taking on the prosecution's forensic experts. Crime lab reports seem to have this aura of invincibility about them that lead few trial lawyers to confront their conclusions head on in front of a jury. Maybe it's because some part of us believes that the reported results are based upon "science", and science, in turn, can be empirically tested. Hence, we reason, if the stuff can be checked, no lab technician would put things in their report that could easily be shown to be incorrect...Or maybe it's because we tremble at how excruciating high school chemistry was and would rather set ourselves on fire than delve back into that pit from hell...Or maybe, just maybe, it's because we simply don't realize how extremely vulnerable to challenge the crime lab work product really is.
Just think about what happens to a piece of forensic evidence from its discovery to the courtroom. It has to be discovered, a process that might in and of itself impact the integrity of the evidence; it has to be collected, another opportunity for messing it up; it has to be packaged, labeled, and transported, three more chances for error; then it has to be stored, removed from storage and again transported just to get it to the lab. At the laboratory the evidence has to be logged in, placed in storage, again be removed from storage, usually be assigned yet another identifying number, be kept from intermingling with other evidence, and be properly documented. All of this before performing any tests at all.
Next our little piece of evidence has to travel to a clean, contamination free work area where it must be properly unpackaged, an art in itself. Then the item must be visually inspected and properly described in detail to document its condition before any work has been performed on it. In most instances it will be photographed, weighed, and sketched. Only now will the lab technician consider beginning any laboratory work.
First the tech will have to figure out what test(s) are appropriate, then determine if sufficient amounts of the evidence exist, then properly dissect the portion to be tested, properly prepare the testing material (which might include the delicate mixing of numerous chemical compounds), all the while continuing to document each step. Only then does any testing begin. Some tests might include as many as five or six separate procedures, each of which must be properly performed and documented, the evidence properly repackaged and relabeled, and once again transported to storage. Then the tech must engage in the very sensitive process of interpreting what their experiments have disclosed. This is a wide open area, ripe for the injection of subjectivity into the process. Only now is a report prepared and the contents of that report must be precisely correct.
But our evidence sample's journey is still not complete. The evidence must next be removed from the lab's storage area, logged out, transported to the police evidence area, logged in, and be properly stored until the DA decides he or she wants more testing performed at which point the whole process begins anew. Throw in the variable that the evidence has to make it to the courtroom for the preliminary examination, back to storage, possibly back to the lab for more testing, back to the police, and so on.
The point is that no other type of evidence is exposed to anywhere near as many opportunities for destruction, mishandling, contamination, and any other conceivable catastrophe that can be brought on by human or natural error, than is forensic evidence. It's amazing that so few of us take the time to scrutinize each step of the process when one small error early on can impact the integrity of every step down the analytical line.
There are three primary areas that counsel should investigate in a forensic evidence case. First, the integrity of the laboratory as an institution, next, the lab technician as an individual, and finally, the integrity of the methods employed in your individual case. In this paper we'll first look at investigating crime labs generally, then talk a bit about looking at the lab technician who performed work in your case, and next, a few ideas about what to look for in the testing process. At the end I'll include a checklist form that might help you keep track of the forensic evidence in a given case and provide a list of discoverable items. So, to begin...
GENERAL LABORATORY ISSUES
Far too often those of us on the defense corner of the case have allowed ourselves to be disheartened, even defeated, by laboratory technicians who are poorly trained, rushed, biased, even unethical, and who, more often than an honorable person would like to believe, render seemingly scientific conclusions that are wholly unsupported by the evidence. Indeed, it's only been in the past couple of years with the publication of the FBI Crime Lab Study1 and the California Department of Justice Needs Assessment Report2, that we've gotten an inside look at just how challengeable are the lab results that in the past seemed so devastatingly unimpeachable.
Let me show you what I mean. Here are just a couple of quotes from the DOJ Needs Assessment Report, a study of seven California State Crime Laboratories published in 19973:
"The consultant found the conditions of these laboratories to be uniformly deplorable."
"Beyond this, all of the labs demonstrated severe life safety, security, accreditation, hazmat, ADA, and workplace safety violations."
"...we believe that the condition of these labs places them at severe risk of losing national accreditation. If this occurs, it will compromise the integrity of the entire Department of Justice lab system."
"As presently housed, cross-contamination risks are common..."
Now look, if a criminal defense lawyer can't do something with ammunition like that...go into real estate.
What these two studies have taught us is that no matter how "reputable" the lab in your case might seem, there is good reason to check it out very closely. You simply never know what you'll find. Indeed, a lot of DA's offices are now employing private forensic laboratories much more frequently which only increases the possibility that the lab in your case engaged in scientifically unsound practices. Bear in mind that we're talking about the quality of science here, not whether the lab is financially successful or been around a long time.
LET'S TALK MONEY HERE FOR A SECOND
A little diversion for a second. Usually when we prepare an attack on laboratory test results, we think in terms of the scientific integrity of the procedures and methodologies followed in a given case. But money too can play a role in an effective cross-examination. A two minute search of the Internet disclosed that during a recent capital murder case a major, nationally known lab hired by the DA settled a fraud suit brought by the US Government for $187 million. You can predict the argument to the jury...If a lab engages in wholesale fraudulent practices, how can we trust their test results? It's a falsus in uno, falsus in omnibus kinda argument.
As the technology gets cheaper, you'll find more and more DNA testing being performed in your cases. In one California county, DNA results are now sought in each and every rape case and even some burglaries. The financial interest of prosecution experts is a primo area for cross. This results from the fact that there are only a few manufacturers of the DNA "kits" used throughout the Country and the competition is fierce. The same folks that produce the kits own several of the labs that perform forensic DNA tests. Any assault on the scientific integrity of the testing, or the kit, aims right at the scientist's Achilles heal of corporate profits. By the way, check out the prosecution experts. These folks often have stock or an ownership interest in the lab. A good area for crossing on bias and interest.
All of this is to say that it is important to be aware of the profit motive issue, as well as the more traditional approaches to scientific evidence when faced with results from a private laboratory.
MORE ABOUT LABS GENERALLY
Just about anyone with a garage and a bit of capital can open a laboratory; a fact to which some of our best clients can attest. As a result, there has to be some system in place for establishing the credentials of forensic laboratories. A couple of the organizations that perform this function include the American Society of Crime Laboratory Directors (ASCLD)4, the National Forensic Science Technology Center (NSFTC)5, and the College of American Pathologists (CAP)6. In addition, labs that specialize may also apply for credentials from an organization, or Board, that regulates that specialty. For example a lab that performs just odontological work might apply to the National Board of Forensic Odontology. Remember, we're talking here about accreditation of the labs themselves, not individual technicians.
What happens is that a laboratory applies for accreditation to one of the various professional organizations that do that kind of thing. To succeed, the lab has to meet certain minimum requirements which include, among other things, the development and publication of: 1) a Quality Control Manual, 2) a Quality Assurance Manual, 3) a Lab Testing Protocol, and 4) a program for proficiency testing. ALL OF THIS IS DISCOVERABLE MATERIAL.
Now I just know that someone is gonna ask what the difference is between Quality Control and Quality Assurance. Here's an explanation published by the National Research Counsel in a recent publication:
The maintenance of high laboratory standards rests on a foundation of sound quality control (QC) and quality assurance(QA). Quality controland quality assurance refer to related but distinct components of a laboratory's effort to deliver a quality product (ANSI/ASQC A31978). Quality controlrefers to measures that are taken to ensure that the product, in this case a DNA-typing result and its interpretation, meets a specified standard of quality. Quality assurance refers to measures that are taken by a laboratory to monitor, verify, and document its performance. Regular proficiency testing and regular auditing of laboratory operations are both essential components of QA programs. QA thus serves as a functional check on QC in a laboratory. Demonstration that a laboratory is meeting its QC objectives provides confidence in the quality of its product7.
That should make it clear, eh? Anyhow, the point of all of this is that when you get a report from a crime lab, know that you also have about a gazillion additional documents to obtain; documents that relate to the lab. This is before you begin to look at material relating to the individual examiner or the tests performed in your case.
A MOMENT ON DISCOVERY
Let's talk a second about discovery issues regarding this material8. You can get it all, and usually without a fight. When you get a case with forensic testing in a particular discipline (DNA, fibers, toxicology, etc) the very first thing to do is locate an expert to assist you. Others at this seminar will discuss obtaining authorization for getting the experts appointed and there are a lot of motions on the subject floating around9.
There are three primary reasons to get your expert on board before attempting to obtain the laboratory's manuals, protocols, and accreditation documents.
First, an expert can educate you about what specific documents to seek, what they are called in the profession, and what they mean so you sound knowledgeable (a psychological advantage). Next, your expert might well have the lab specific documents from a prior case, though labs learn too and make periodic revisions. If your expert hasn't obtained lab manuals for some time, get the current version just to be on the safe side. Finally, if the DA is gonna oppose your discovery demands, an expert's declaration as to the need for the material you seek usually gets the job done, and if not, makes a great record.
If you think that the DA in your case will be a jerk about providing discovery, contact the laboratory directly before you approach the DA. Regardless of whether the lab is run by a bunch of cops in lab coats or not, they tend to fancy themselves "scientists" and will want to show off how scientifically together their lab is. Hence, you can often get material directly from the lab that the DA won't understand, let alone willingly provide. We're in trial now in a death case where we got all of the lab notes from the lab. It's a blast using them against the prosecutor's witnesses, while he keeps jumping up and screaming. "What is that? Where'd you get that?", and the witness meekly answers for me, "Ah, sir, it's ours".
If you really want to pick a discovery fight, go after the ASCLD internal documents upon which the lab's accreditation is based. I haven't tried this since Proposition 115, but it seems that if the lab is bootstrapping their own credibility by claiming ASCLD approval, we should be able to test the facts underlying that approval.
SO NOW WHAT DO I DO WITH ALL THIS @#%$ STUFF?
Okay, so now you have a few hundred pages of highly technical manuals that look like some Etruscan recipes for souffle a' sphincter of newt, what do you do with 'em? The answer is two fold. First, you don't get bogged down trying to assimilate all of the information, you can't do it. But you should be familiar with the proper titles and purpose of each document and have at least a working idea of what's covered by each. Let your expert take it from there.
The expert should first do an overall review to be certain that the manuals are up to date. If not, you'll have a great time. Imagine yourself being cross-examined on why you filed a state of the art motion without checking the pocket part updates or advance sheets. An ugly thought, huh? Well that's exactly what it would be like for a prosecution expert to testify based upon out of date procedural manuals.
If you are working with a lab test that you think is subject to a Kelly/Frye/Daubert motion, the content of the protocols and manuals becomes critical. One of the hallmarks of acceptance in the scientific community is the distribution of the protocols employed by the lab so they can be subjected to peer review. How can a scientific practice be generally accepted if documents relating to the methodologies utilized have been kept secret? Remember that profit motive issue discussed earlier? A lot of labs out there who want to be on the cutting edge of the distribution of new technologies also have a proprietary interest in the process and keep their material very close to home. Great area for Kelly examination.
Try to think of the QA, QC, and other lab manuals as though they were Police Procedures Manuals, and you can use them in the same way. None of us are shocked when the CHP Officer testifies that he observed our client for the 15 minutes (or whatever it is) before administering a breath test. He does it all the time and expects the question to be asked at trial. Not many lab techs though, expect to be questioned about the number of microliters of blood it takes to get a Hemostix reaction. See what I mean?
One last issue on labs generally. Before a lab begins to perform tests in any particular discipline, it has studies performed relating to the lab's ability to accurately perform the particular type of test. These are called "validation studies". Ask the lab for a list of all validation studies performed for the type of testing in your case. If you find that there are any that bear on your issues, demand copies. We recently found a validation study in a lab on the drying time of semen, a seminal (sorry) issue in the case.
Alright, so enough about laboratories in general. Keep thinking about this while reading the next section because there's some overlap between the lab and the lab techs, particularly in the area of proficiency testing.
TECHNICIAN SPECIFIC ISSUES
Not unlike the lab itself, those who perform the actual tests should meet certain prescribed standards. The traditional area of inquiry are those of education, experience, and proficiency. It's pretty tough to get a clear shot at a lab tech on lack of educational qualifications because judges, like most of us, struggled with chemistry 1A, and are thus easily impressed with virtually any such schooling. But sometimes experience, and often, general proficiency, are fertile areas to explore10.
The cross on "experience" is generally just what you'd expect. When this area mostly bears fruit is when the witness is either new on the job, or is testifying about a new technique. You can expect to see this more and more as DNA testing is brought online at local labs. The DOJ presently has only three labs doing DNA testing but they plan to implement this technology at another six labs in the coming year. Gonna be a lot of rookies out there.
I've mentioned "proficiency testing" several times so far, so let's go into it a bit here. Proficiency testing is one of the primary methods employed in determining if the lab techs individually, and the laboratories as institutions, are performing up to the standards of the profession. In these tests, samples to be examined are given to a laboratory or particular technician, but the results are already known by a test giver. There are two methods employed in administering these tests, blind and known. In the blind test, the lab tech doesn't know that a test is taking place; they think the evidence sample they are working on is just another case going through the lab. The open proficiency test is like an open book exam.
Make sure that your discovery demand includes a request for the results of the lab's and lab tech's proficiency tests. We recently found a technician at Berkeley DOJ who seriously messed up a blind proficiency test. Based upon her results an innocent man would have gone to prison. Not only did it take 6 months for the tester to catch the error, but when the lab tech was instructed to correct the results, she screwed them up too. Guess what? The laboratory's records reflect that this technician has passed each and every one of her proficiency tests.
The reason that I included the example is that it illustrates that you can't rely upon bald assertions that the lab tech in your case has a blemish free proficiency test record. You have to get at the data underlying the results. Include a request for it in your discovery demand. No doubt the lab will reply, through the DA, that this is too burdensome a request with which to comply. "Okay", you'll rejoin, "Let my expert go to the lab for an hour or so to review the data and we'll only ask for copies of that which we believe is exculpatory". The bottom line is: get your expert into the lab to review the data underlying the proficiency tests for each tech in your case. That's where you'll find the meat of the coconut.
Just like the laboratory generally, there are associations that individual technicians join to beef up their resumes. Some of these include: the American Academy of Forensic Sciences (AAFS)11, the American Board of Criminalistics (ABC)12, California Association of Criminalists (CAC)13, and the California Association of Toxicologists (CAT)14. You know how impressive it sounds when the DA's witness testifies to all of the professional organizations to which he or she belongs. But be sure to get an updated CV for the lab tech who worked with your evidence and then check out the organizations listed there. You'll find that most of them require only:
1) employment in the field, and 2) $25 a year. That's it.
Though some of these organizations do have certification programs for laboratory technicians, here's something interesting in that regard. Just about every organization that does certify lab techs are multi-disciplinary and so are their certification tests. This means that when your lab technician was tested, it was with an exam that included say, toxicology, ballistics, fingerprinting, fibers, and hair, at the same time. Since a passing score on the test is 70% or 75%, the expert, if honest, will have to admit that they could have flunked every question in one area yet still have passed the test and obtained certification. Of course, it's certainly possible that the area failed is that about which the witness is testifying in your case (hint, hint).
Note that a number of organizations to which your lab tech might belong publish a laboratory technician's Code of Ethics. Get it, read it and I'll bet you dollars to doughnuts that there will be something in there you can use in your cross-examination.
A final word about looking at the lab technician. Try to find as many transcripts of prior testimony by the witness as possible. Most of the lab techs in action today have been around for years and nobody, but nobody, can testify time and again and not make contradictory statements. Reviewing transcripts also gives you ideas about how to frame questions, how the witness performs on the stand, and lets you design your cross based upon anticipated answers. If the witness tries to mess with you by giving you an answer you don't expect, simply use the transcript to impeach them. Don't be shy, ask around the courthouse, check the Net, contact the local Public Defender's Office, and get those transcripts.
CASE SPECIFIC ISSUES
Most often lawyers obtain a copy of the prosecution's crime laboratory report and that's it. Never, never, never again litigate a forensic case without getting all of the laboratory bench notes. Here's what this is all about. One of the most basic requirements for proper scientific procedure is for the technician to thoroughly document every single thing that happens to the evidence. You might not know it, but when a piece of evidence arrives at the lab, a file is opened and a notation is made, then, each and every thing that happens to that piece of evidence is written down in the file as well (or at least should be if proper and accepted scientific practices are followed...hint, hint).
Get the benchnotes! The files usually have a wealth of information about each piece of evidence. Get the benchnotes! The file usually contains photographs and sketches of the evidence annotated with comments. Get the benchnotes! In a recent case there was an issue about whether material was cut out of a pair of panties or whether they were just torn. The DA's criminalist was locked in by a one word notation on his benchnote diagram of the shorts and he became our witness. Get the benchnotes!
One of the wonderful things about these benchnotes is that they can be useful for what they don't include as well. In a recent fingerprint case, the examiner testified at the preliminary hearing to twelve, count 'em, twelve points of identification. Well, that's what his benchnotes said as well...but that was all the notes said. That left us free to ask questions like, "So what was the very first point of identification you observed? How about the second?", and then drag him through each possible type of identifying characteristic. This resulted in about sixty consecutive "I don't know" replies (at least 5 types of characteristics X 12 pts of identification).
Get the benchnotes! Now remember the people doing the analysis of your evidence are suppose to be unbiased scientists. In a recent case we claimed that some slides had been screwed up by the DOJ lab tech. When we got the later benchnotes she had included her very personal thoughts about my comments on her work, ending with something in the nature of, "This should show Kruglick he's full of it". Turns out she was wrong, the slides were screwed up. But there are two good lessons here. First, lab techs are human and you can get to them in a way that effects their work, and second, benchnotes can sometimes disclose the tech's bias sufficiently to impeach their findings. Get the benchnotes!
By the way, benchnotes are not confined to laboratory forensics. During an autopsy, most pathologists either dictate a contemporaneous tape of their observations, or actually make contemporaneous notes. Get them! By the time you get the final report, it might look nothing like the original notes. If the pathologist later finds out from the DA that he needs to find evidence of rape, it's quite amazing how insignificant observations can suddenly be reinterpreted to become evidence of terrible trauma consistent with a sexual assault. Not if the pathologist knows that you have the benchnotes!
As an aside, if you have pathology photos in your case, get the negatives and have them scanned onto a CD. You'll get far more information than from a normal photo, and can zero in on certain areas to an extremely high magnitude. Recently had a pathologist claim a wound was proof of a rape. When magnified on a CD, the wound turned out to have rolled edges and a small white ring of tissue around it. This proved it was healing and couldn't have been the result of a rape at the time of the homicide. The pathologist interpreted the evidence wrong. Since I'm on the subject of interpretation...
There comes a point in virtually every lab test when the experiment is complete and the tech has to make some sense of their findings. Here is where you and your expert can find the most fruitful areas for uncovering error and bias. In another recent case a technician issued a report that claimed only my client's DNA showed up on the instrumentality of a homicide. In the benchnotes it was clear that she had found, not his, but someone else's DNA on the weapon. She claimed that it was her interpretation of the test that the additional DNA was only the result of a common glitch in the testing procedure and thus, she elected not to include it in her report. Should have heard her trying to explain that one on the stand. Without the benchnotes, we never would have known!
It's funny how evidence taken from the defendant is initially described in benchnotes as being "consistent" with that found at the crime scene, but by the time you get to trial, it a "match". Without the benchnotes for impeachment, this distinction would be lost. This issue of interpretation comes up with just about every kind of evidence from hair to fingerprints, from DNA to ballistics. Make sure that you arm your experts with all of the information that exists.
During the interpretation process most laboratory technicians will refer to some documents or another in reaching their conclusions. An example of this might be a catalog published by gun manufacturers in a ballistics case. Be sure to obtain copies of all documents relied upon by the lab tech. Might find he or she looked at the wrong page or transposed some numbers.
Now, in just about every scientific test there are suppose to be built in "controls" that tell the technician if the test is working properly. Some clever operators keep the control information in a different file than the benchnotes and other case material. This is particularly true if the tech is performing experiments on evidence from several cases at the same time. The control information somehow ends up in the case file that isn't presently going to court. Be sure that you ask for all positive and negative controls for a period before and after the tests run in your case.
By the way, the laboratory file will also have a communication log in it. This will include the contents of every conversation the lab has had with the DA and police. I haven't found a case that says we're entitled to this log, but I have had more than one lab tech include it when they produce the benchnotes. These guys make for some very interesting reading.
As a practice guide, if you find errors in the laboratory process, give a lot of thought about whether you want to keep it to yourself for later use at trial, or go after the tech at the preliminary examination. Remember, if there is any of the evidence left after testing, the lab can go back and re-test it to correct their earlier mistakes. A second practice guide: get the benchnotes as early as possible and make later repeated requests for any more that might exist. It's not often that all testing is completed at the outset of the case and you'll want to be sure that as testing is performed you get the additional benchnotes.
Two last thoughts: First, a lot of labs are now using computers and scanners in the testing process. They might obtain a gel in a blood test, scan the results, destroy the original gel, and leave you with only a funky copy for your experts. We've been successful in forcing labs to produce computer disks (usually Zip Disks) containing the actual scanned image for our experts to review.
Finally, a word about retesting. Give a great deal of thought about whether you wish to have forensic samples retested, or strictly rely on an attack upon the prosecution lab's work. It's a balancing process. For sure the DA will ask his or her expert if a sample was available for defense testing. If you didn't avail yourself of the opportunity, it will come out; but so too will the fact that a sample was delivered to a defense lab for retesting and no such test results were introduced by the defense at trial. On the other hand, retesting might just exonerate your client. The best of all possible worlds here is for the prosecution lab to destroy all of the physical evidence during their testing process. Your retest decision is made for you and you can point to the fact that it is the consensus of the scientific community that retaining a sample for defense retest is the primary means of assuring the integrity of the prosecution's laboratory results. Bottom line: Have your expert take a look at ALL of the DA's lab's material (including prelim and other lab related motion transcripts) before making a decision on retesting...remember who has the burden of proof.
I hope that this paper in some way brings you comfort when faced with the forensic component of your next case. There is no reason to be shy about looking into the data that went into the creation of the crime laboratory report, and there's certainly no reason to take the report at face value. Seldom, if ever, are the forensics in a case as tight as the prosecution would want you to believe. There are simply too many opportunities for common human errors to have an enormous impact upon the accuracy of the lab test results not to just...Go for it!
Links will open in a new browser window.
1. Found at http://www.usdoj.gov/oig/fbilab1/fbil1toc.htm.
2. Found at http://www.kruglaw.com/.
3. Copies of the report in hard copy are available for $25 by contacting the Law Offices of Kim Kruglick at 415.383.5030 or firstname.lastname@example.org.
4. Found at http://www.shadow.net/~datachem/ascld.html.
5. Found at http://www.shadow.net/~nfstc/.
6. Found at http://www.cap.org/.
7. National Research Council, The Evaluation of Forensic DNA Evidence
8. Don't worry about what specific documents to ask for yet, I'll provide a list in the last section of this paper.
9. If you're desperate, e-mail me at email@example.com and I'll either fax something out to you or give you Jeff Thoma's home phone number.
10. Proficiency here means general historical proficiency, not how they did in your particular case.
11. Found at http://www.aafs.org/app.htm.
12. Found at http://www.criminalistics.com/ABC/.
13. Found at http://www.criminalistics.com/CAC/.
14. Found at http://www.Cal-tox.org.
DISCOVERABLE MATERIAL CHECKLIST
Laboratory Specific Material
Technician Specific Material
Case Specific Material
FORENSIC CASE ISSUE CHECKLIST
1. Evidence collection
2. Evidence Transportation and Storage
3. At Laboratory