Private Investigations and Personal Security/Investigation/forensics


Any information regarding the importance of being effecient during a crime scene investigation.  What are the primary things that you look for and how is it that your conclusions are made from the evidence you have gathered at the scene of the crime to make an appropriate arrest and or leads to a suspect.


    Crime scene analysis (aka crime scene response) is much more than processing (searching) and documenting (notes, photos, sketches), and certainly more than bagging (collecting) and tagging (preserving evidence).  When done right, crime scene analysis is a slow, methodical, systematic, and orderly process that involves protocols and a processing methodology.  Far too many investigators cave into pressure to get the scene working and functional again, especially if it is an area of commerce.  Having a method or game plan protects against charges the scene was ransacked or dropsied.  In fact, some police departments now require an onlooker to sign up as civilian monitor.  Another thing that detectives have frequently done wrong is restrict the flow of information from a crime scene.  This often takes the form of keeping journalists and the media away, as well as keeping valuable, timely information from other law enforcement personnel.  It's far better to set up a media liaison post along with a command center near the outer perimeter.  It's important to remember communication and team work are the hallmarks of good crime scene analysis.

   With media relations, identity of the victim is usually released unless the victim is deceased (and next of kin have not been notified), a juvenile, or victim of sexual assault.  Also usually released is the type of crime committed with a brief description of what, when, and where (Blaricom 2001).  For liability reasons, the following information should be withheld from the media: amount of money or property loss; identities of any witnesses, whether any interviews or interrogations are going on, and any statements impugning the character or reputation of parties involved.  Any custodial arrests made in the case must be reported to the media.  Dempsey (2003) also rightly points out that the days are gone when police can automatically consider crime scenes as falling under a warrant exception to the Fourth Amendment.  A crime scene emergency exists only when officers reasonably believe that a person inside needs medical attention or there are other victims or perpetrators inside (Mincey v. Arizona, 437 U.S. 385 1978).  Who gives consent to search a crime scene is also an issue with the courts, so it's best to have a warrant, easily obtained since any crime scene by definition merits probable cause.          

   Beyond the usual way of classifying scenes by type of crime, they can be classified as primary or secondary (Lee et. al. 2001).  The primary scene is where the body or victim was found.  Secondary scenes may include the victim's home, suspect's home, suspect's vehicle, the road between suspect's and victim's homes, or any other comparable indoor or outdoor area.  For many secondary scenes, it's not necessary to treat them in a microscopic manner (looking for trace evidence such as hairs and fibers).  A macroscopic view may suffice, such as obtaining overview or geographical information.  Other ways to classify crime scenes include the scene condition (organized or disorganized), which covers the possibility of staging (see this article by John Douglas on Crime Scene Staging).   

   Establishing and protecting the boundaries of a crime scene are often said to be the most difficult tasks (Ramsland 2001).  Some departments use dogs or search teams to establish boundaries, but the most common distinction is made between inner and outer perimeter (Dempsey 2003).  These are mathematical concepts referring to when you draw a circle around a box, the outer perimeter of the circle is 50% larger than the inner perimeter of the box.  An inner perimeter is the immediate area where the crime was committed.  An outer perimeter is the surrounding area which includes any entry and exit points, or in the case of a shooting, any area where spent ammunition might be found.  There's also something called the extended perimeter, which is where any evidence might have been thrown by the suspect while fleeing.  If the scene involves barricades, hostages, bombs, or other threats, a SWAT team, ERT, Bomb squad, or HAZMAT unit will determine perimeters.  Safety is of paramount importance at any crime scene so be sure to wear protective clothing and remain alert for anything that can stick you.

   Stabilizing a crime scene is often not talked about enough.  One of the most frequently asked questions by students is whether they should immediately rush into the scene and check for signs of life in the victim.  After all, most textbooks emphasize that a first responder's duty includes first aid.  The answer no one wants to talk about is no, not right away.  The only times a responding officer should rush into the scene is when someone is laying there, in your opinion still alive (breathing), moving, and/or reaching for a gun.  Removal of potential threats to self and others (fellow officers and citizens) takes precedence over first aid to those already inside the crime.  If the victim is still alive, an attempt should be made to take a dying declaration.  EMS and fire personnel are trained to sensibly enter crime scenes so that they follow a safe pathway which is where the least evidence is disturbed.  If possible, the responding police officer should try to find the suspect's and victim's entry and exit points, and direct emergency personnel to enter and exit at another point, or via a pathway the officer has already established in a check for signs of life.  Any of these kinds of emergency actions should be documented in notes, or better, with a crime scene log that has been set up.  Every effort should be made not to disturb the crime scene, and preserve it in as pristine a condition as possible.

   Command at a crime scene may seem a little haphazard.  Patrol officers are usually the first responders, and they should be in charge until relieved by their sergeant or officer of higher rank.  Usually only a sergeant can relinquish command to a detective, but the uniformed officers should remain under the supervision of the sergeant.  The following chart illustrates the role of these important first response officials.          



1. Record exact time of your arrival and/ or notify HQ that you are on the scene. 2. Enter immediate scene using safe path of entry. 3. Check for survivors and render first aid. 4. Secure and define the entire scene by noting all exits and paths of entry. 5. Isolate a perimeter with some type of barrier. 6. Isolate witnesses and remove others from the immediate area 7. Ascertain whether or not any evidence is present and control its condition. 8. Request backup. 9. if possible, take an unobtrusive photo of any crowd     1. Take an initial survey of the area, developing a mental image to ensure the scene is preserved. 2.Record names, addresses, dates of birth and telephone numbers, etc. of all persons present. 3. Set up a command post if police are to be at the scene for any length of time. 4. Start a crime scene log to enter everyone who enters the crime scene. 5.Interview witnesses. 6. Notify the homicide division and record time of notification and who was notified.    1. Record exact time of arrival. 2. Interview witnesses. 3. Canvass the area and note surroundings. 4. Record time, weather, lighting, and number of people at scene. 5. Interview first officer and other police to determine sequence of events. 6. Arrange transport of witnesses to headquarters and take written statements. 7. Record location and description of the body, including clothing. 8. If identity of victim is known, run a background check. 9. Ascertain whether or not any suspects are in custody.


   So far, we've only been talking about first responders, and these officials usually go down in the records as responding or reporting officers.  Now, we're going to talk about higher ranking personnel, such as the preliminary investigator (sometimes called the main or principal investigator), and the follow-up (often called the lead or chief investigator).  The distinction between preliminary and follow-up here involves detectives and teams of detectives.  There are a variety of duties that need to be divided up.


1. Conduct preliminary scan or survey (walk-through) of boundaries. 2. Expand boundaries as needed. 3. Assist with photography and sketching the crime scene. 4. Assist with appropriate search patterns. 5. Process marking, bagging, and tagging of evidence. 6. Take detailed notes. 7. Coordinate questioning of witnesses and suspects. 8. Conduct primary crime reconstruction theory.       1. Maintain crime scene command post. 2. Ensure assignments in keeping with attitude, aptitude, training, and experience. 3. Liaison with coroner, medical examiner, criminalists, and media. 4. Collate collected evidence for storage and transport. 5. Prepare official reports 6. Make decisions on the kinds of lab tests needed and any outside specialists needed. 7. Help question witnesses and suspects, if need be. 8. Organize neighborhood canvass. 9. Conduct final walk-through. 10. Conduct final debriefing and decide when crime scene dropped  


   Many instructors, myself included, hesitate to expose students to the checklist approach to something as important as criminal investigation.  The problem is there will always be someone who follows the checklist so closely they never learn anything, but are capable of going thru the motions.  Crime scene analysis is so situation- and logic-dependent that it defies standardization.  So that having been said, and with full awareness that checklists can be easily found elsewhere and are frequently used by rookies as well as a few police departments, here's some basic crime scene protocols that should be adhered to at all crime scenes.

   The most generic protocol consists of the following steps: 1. INTERVIEW, 2. EXAMINE, 3. PHOTOGRAPH, 4. SKETCH, and 5. PROCESS.  This means that there should be a lot of communicating going on in the early stages.  Examine in this context does not mean looking for evidence, but it does mean looking around to establish boundaries, find witnesses and possible suspects.  Photography always comes before sketching and searching.  Processing means searching for, collecting, and packaging evidence.  Note-taking occurs throughout all the steps.

   Another tried and true protocol involves 17 steps, and is provided by Gardner (2004) as follows:  (1) Initial NOTIFICATION, (2) Coordination, Assessment, and Team CALLOUT, (3) Conduct initial OBSERVATIONS, (4) Deal with DECEASED, (5) PHOTOGRAPH the scene, (6) DOCUMENT overall observations, (7) SKETCH the scene, (8) Conduct a first RECHECK, (9) Release the BODY, (10) Collect items of EVIDENCE, (11) Conduct a second RECHECK of the scene, (12) Conduct a third RECHECK of the scene, (13) Check BEYOND the scene, (14) Conduct an on-site DEBRIEFING of the investigative team, (15) RELEASE or secure the scene, (16) Process and PACKAGE evidence, and (17) Conduct a FORMAL debriefing.  The following is an expanded checklist for all crime scenes:




         C. DIVIDE UP DUTIES/DIVISION OF LABOR. Talk with first responders to ascertain extent of contamination. Identify principal and lead investigator and other officials at scene to work out your role in the investigation.

         D. ESTABLISH SCENE SAFETY PRIOR TO ENTRY. Protect integrity of the scene from contamination by people, animals, elements. Remove risks from hostile crowds, collapsing structures, traffic, and environmental threats.


         A. ESTABLISH PERIMETERS, COMMAND POST, GARBAGE DUMP, AND MEDIA CENTER (Set up boundaries and staging areas by conducting scans, surveys, or "walk throughs" without actually walking through anything)

         B. INSPECT FOR SUSPECT ENTRY AND EXIT POINTS (Document the scene's location, address, mile marker, or building name)

         C. DETERMINE YOUR ENTRY AND EXIT POINT (Usually not the same as the suspect's unless the situation dictates otherwise)

         D. RECORD INITIAL ACCOUNTS OF THE INCIDENT FROM WITNESSES (Engage in briefings with other personnel as needed; keep eyewitnesses separate so they don't talk to one another)


         A. PHOTOGRAPH ENTIRE SCENE (with wide-angle views), TELL A STORY, PHOTO OBJECTS TWICE AND WITH SCALES (Begin to establish a chain of custody by identifying what kind of evidence is at the scene and who will be the custodian of it)

         B. SKETCH TO SCALE OR NOT TO SCALE ACCORDING TO APPROPRIATENESS OF SITUATION (This becomes part of written narrative which correlates with photographic documentation and denotes any evidence that has been moved)







         (2) STRIP (aka LINE)  The area is divided into north-south strips, and a team of 6+ people walk parallel to one another. USEFUL IF TEAMS ARE AVAILABLE AND YOU'RE OPEN TO THE POSSIBILITIES OF ALL KINDS OF EVIDENCE. Stakes and twine are sometimes used to keep lanes straight.

         (3) GRID (area is divided into north-south and east-west strips. This allows a secondary search of each area from a different direction.) USEFUL IF TEAMS ARE AVAILABLE, YOU'VE GOT A LARGE AREA, AND ARE LOOKING FOR HARD-TO-FIND EVIDENCE.  If stakes, twine, and mapping are used, your search is imitating archeological methods.

         (4) ZONE (the area, usually a room, is divided into equal size zones, and each zone is assigned a searcher.) USEFUL IF TEAMS ARE AVAILABLE AND TRACE EVIDENCE IS YOUR MAIN CONCERN.  Sometimes, a multijurisdictional scene will involve zones.

         (5) SECTOR (aka WHEEL or PIE) (a large area is divided into pie slices, and then the same or different search patterns are used in each zone.) USEFUL IF THE SCENE IS LARGE AND YOU'VE GOT DIFFERENT KINDS OF EVIDENCE SPREAD OUT ALL OVER THE PLACE. It is rarely done on foot, and more likely involves the aerial search pattern that the Coast Guard uses.

         D. COLLECT EVIDENCE (Following local, State, and Federal laws for collection and admissibility) In presence of a witness, INVENTORY, COLLECT, and SAFEGUARD any drugs, paraphernalia, medication, money, valuables, or personal property. Participate in any scene debriefing to determine post-scene responsibilities, share data, and determine need for specialists.




1. APPROACHING - Observe persons carefully, odors, elements. Exercise extreme safety.

2. CONFIRM OR DISCONFIRM DEATH - Locate and view the body, noting the success, failure, or futility of resuscitative efforts.

2. PRESERVING - Establish perimeter. Set up command post. Determine suspect's point of entry and egress and your own.

3. PROCESSING - Photograph scene, body, and face. Place markers. Photograph markers. Photograph body. Sketch the scene. Search the scene. Examine evidence in detail. Take notes. Tag and bag. Describe and document.

4. IDENTIFY THE VICTIM - Estimate cause, manner, and time of death. Obtain exemplars and controls. Look for ID.  Look for drag marks. Note discrepancies in mortis and body temperature.

5. NOTIFY NEXT OF KIN (and be prepared to assist the family through an autopsy and financial advice).

6. DEVELOP THEORY OF MOTIVE - Rely upon evidence, knowledge of victim's activities, appearance of victim's clothing. See if any documents written by or sent to victim recently. Determine pre-scene activity and health status (physical & mental) of victim.

7. SEEK ADDITIONAL INFORMATION - Do background and history checks (marital, family, sexual, employment, financial, daily routine, friends, religion, education, criminal history). Obtain leads from who knew the victim. Challenge discrepancies in witness' knowledge of the victim or lack of corroboration with other witnesses. Order warrants on suspects.

8. QUESTIONING - Question all suspects. Make use of evidence during questioning. Use information withheld from public about case to obtain confession. Destroy alibis.

1. APPROACHING - Observe vehicles carefully, be inconspicuous. Set up surveillance and backup teams.

2. PRESERVING - Use diagonal coverage. Avoid further contamination than necessary. Use garbage dump. Determine modus operandi (type of building, entry, loot, time of operation, partner usage, trademarks).

3. PROCESSING - Photograph exterior/interior, points of entry/exit. Take precise measurements of impressions, tool marks. Diagram crime scene.

4. INTERVIEW VICTIM - Obtain whereabouts, acquaintances, recent visitors, and list of stolen property. Check for history of insurance claims. Take family history.

5. FINGERPRINTING - Determine if identifiable clues remain -- prints that don't match exemplars of those at scene, tool marks, footprints outside, fibers if appropriate. Photograph or diagram both prior and after removing or lifting.

6. USE VICTIM AS INVESTIGATOR- To determine if anything out of place or has been moved. If suspect helped themself to food, drink, urinated or defecated.

7. CANVASS - Conduct canvass of neighborhood for suspect and vehicle descriptions.

8. SURVEILLANCE - Keep home under watch. Track down possible receivers and suspects. Work an informant.

9. EVIDENCE TRACING - Prioritize property list. Check pawn receipts. Use police records. Use open sources of information.

10. NOTIFY - Other departments of property list and modus operandi.

11. DECOY OR STING - Offer opportunities the suspect finds especially attractive


   Photography should be conducted before anything else is done to the crime scene.  All evidence is flagged or marked before being photographed.  Crime scene photography involves both color and black-and-white (contrast) film, both analog and digital cameras (auto focusing and exposure SLR, or single lens reflex, cameras tend to be standard), tripods to keep the shots steady, a variety of filters and lenses, an assortment of scales or rulers to put in the photos, and extension flashes or other lighting to paint the scene with light.  For general patrol use (documenting simple crime scenes, traffic collisions, etc.) just about any digital camera with 2 to 3 megapixels is adequate. For crime scene investigation, the digital camera should have 4 or more megapixels, close-up capabilities, and flash attachment. The more pixels, the more detail captured. This is important when photographing small items of evidence. Also, the difference in megapixels is important when making prints for court.  2 megapixels gives a good 5"x7" print. 3 megapixels gives a good 8"x10" print. 4 megapixels gives a good 11"x14" print. 5 megpixels gives a good 16"x20" print.

   Two photos should be taken of each shot in case one is blurred.  There are three (3) general categories of photographs: (1) overview, (2) mid-range, and (3) close-up.  The photos that are overview (locale and approach route) and mid-range (10-20 feet) tell a story that helps establish the modus operandi of the offender.  Close-up photos are essential for establishing the corpus delicti of a criminal act.

   There are two (2) general methods of photography: (1) overlapping, which is a series of photos taken in a circular or clockwise direction, overlapping each slightly to show the overall scene, and (2) progressive, which starts from a fixed point, photographs each piece of evidence as the photographer moves toward it, and progressively gets closer in the pictures. Appendix B of the Osterburg & Ward text gives Suggestions for Photographing Crime Scenes.  Bodies are photographed from five angles: (1) head to feet, (2) right side, (3) feet to head, (4) left side, and (5) straight down from above (Ramsland 2001).  


   Once the scene has been photographed, the investigator will need to sketch the crime scene.  A sketch is more than a note but less than a photograph.  Sketches contain measurements of the entire scene, and if there is a body, measurements are taken from two fixed points.  Sketches also contain a legend matching up each piece of evidence with its flag or marker number, although sometimes this is only on the finished sketch instead of the rough sketch.  The principal investigator usually starts with a rough sketch that contains depictions and dimensions. The rough sketch will later produce a finished crime scene sketch to scale (usually one-eighth inch equals one foot for indoor scenes and 1 inch equals 20 feet for outdoor scenes).  A finished sketch may become the basis for a model or mockup the prosecutor uses in court.  A finished sketch is usually the result of a team of investigators working together on it.

   There are four (4) types of sketches: (1) Overhead Sketch (often called the "birds-eye" view or the "floor-plan" depicting the scene as you would see it in an aerial photograph), (2) Exploded View Sketch (called this because it resembles what would happen if you exploded the inside of the room and all the walls collapsed outward), (3) Elevation Sketch (looking at the scene from the side), and (4) Perspective Sketch (adds a third dimension to the scene, and requires some artistic talent).


   The ultimate purpose of a search is collect associative evidence that links a suspect to the crime or victim.  The type of terrain usually determines the search pattern used.  Start the search for evidence with the probable access and escape routes. Weapons and tools are frequently discarded along these routes, and be sure to look in other unusual places such as the refrigerator or bathroom.  Pay special attention to any areas or objects that seem to have received attention by the criminal.  During the search, notes should be taken about the location and condition of anything found.

   Canvassing a neighborhood is an attempt to search out witnesses who may not know they have useful information about the crime under investigation.  It is not normally a widened search for evidence.  Motive and opportunity (not theories) are the best types of information canvassed witnesses can provide, so it's smarter to use a canvass after you have identified some suspects and the victim at least.  Also, since perpetrators usually live near the scene of a crime, you can sometimes shock them by having police show up at their door.  Officers who conduct canvasses should be especially sensitive to anyone who appears unusually nervous or calm since such nonverbal reactions might be construed as a soft confession, or admission.  The same applies to any onlookers or witnesses questioned at the crime scene.       


   Crime scene notes should contain descriptions of the crime scene (signs of struggle, bullet holes, areas having a large amount of evidence), descriptions and locations of physical evidence, the disposition of physical evidence, and any personnel in or out of the crime scene area.  Notes must be comprehensible and chronological as they might be called upon to be revealed as part of a pre-trial discovery process.  Notes serve the function of compensating for loss of memory, and a familiar tactic in court that lends credibility to a detective is where they are allowed to consult their notes.  Notes also qualify as res gestae evidence, or spontaneous utterances, which carry more weight in court as an exception to the hearsay rule.  This can be very useful when the notes have recorded the first moments of what was said or done by a witness or suspect.          


   Fragile evidence is collected right after being photographed.  Vacuums are used for fiber, dirt, glass, and hair.  Plaster or dental stone are used for footprints and tire tracks.  Fingerprints, shell casings, firearms, bodily fluids, bite marks, and tool marks all have specific methods of removal.  Weston & Lushbaugh (2003) list the evidence found at crime scenes as falling into seven major groups: (1) weapons, (2) blood, (3) imprints or impressions, (4) tool marks, (5) dust and dirt traces, (6) questioned documents, and (7) miscellaneous trace or transfer.  Marking occurs at the time of collection, and the detective marks something by scratching their initials and date on the evidence itself, if possible, and if not, on an evidence tag.  Critical pieces of evidence, such as the weapon, should definitely have the detective's mark because this establishes the foundation for that detective's testimony at trial.      

   Human bodies require special attention.  Detectives are only allowed to make non-intrusive examinations and do sketches.  Examples of non-intrusiveness include looking in the eyes, smelling for any odors, and superficial examination of wounds and injuries.  As any Death Investigator who works for a coroner or medical examiner will tell you, "the body belongs to them" not the detectives.  Even criminalists and crime scene technicians are only allowed to clear a path to the body.  Death investigators are the only ones usually allowed to examine wounds more closely.  The body usually gets quickly wrapped in a white sheet (to preserve evidence) and is then placed in a body bag for shipment to a refrigerated storage facility such as a morgue.  If the identity of the victim is unknown, their full description is first run through a Missing Persons database and NCIC, then their fingerprints through AFIS, then their DNA through CODIS (which takes several days), then the dental records of nearby dentists, then any restaurants likely to have served what was last eaten (determined from the autopsy report), and then in a public appeal for help in the newspapers.

   Obtaining control standards is important.  When "unknown" samples or specimens are collected that are believed to belong to or have been transferred by the suspect, a "known" sample must be collected so forensics can determine if the "unknown" is different from the "known" specimen.  With hair, samples are collected from the victim and other persons lawfully present at the time of the crime. This can be done at a hospital.  With paint, "known" samples are collected from "known" surfaces.  With blood, samples are collected from victims and other persons lawfully present at the time of the crime. This can be done at a hospital.  With soil, "known" samples are taken from areas around the area in question that contains the "unknown" substance.  With fingerprints, elimination fingerprints are collected from the victims and other persons who are lawfully in the area of the crime.


   Be prepared with a wide variety of packaging containers and collection tools.  Trace evidence is never removed from any object that is carrying it; the whole object is bagged.  If two or more similar objects are found, they should go in separate bags, even though they are similar.  Blood stained material should be air dried and placed in separate packaging that can breath.  They should then be stored in an area with good ventilation.  Charred debris should be placed in an airtight container to prevent evaporation of petroleum residue.  Appendix A of the Osterburg & Ward text gives FBI Suggestions for Packaging Physical Evidence.

   Once all known evidence has been collected and packaged, and all other information has been collected from the scene (photographs, diagrams, and notes) a decision must be made on maintaining the crime scene or terminating the crime scene.  This decision will be based on an assessment by the lead investigator after reviewing the evidence collected and estimating the likelihood of anything else of investigative value being present.  If there is doubt, the police will maintain the perimeter with an officer present to ensure integrity. Once the decision has been made to drop the crime scene, all equipment and reports are collected and finalized, and all evidence is transported to the evidence unit and/or crime lab.  The search warrant is signed and returned to the court, along with a list of items seized under authority of the warrant.

   The logical end of crime scene analysis is crime reconstruction.  A plausible theory of who, what, when, where, and why the crime happened should develop from all information involving the victim, witnesses, crime scene evidence, suspects, questioning, databases, and records (Lee et. al. 2001).  Finalized notes and reports will have at least the following segments:  1. suspect information, 2. harm or property damage, 3. physical evidence analysis, 4. victim information, 5. statements of witnesses, and 6. observations and opinions of the investigator.  

Private Investigations and Personal Security

All Answers

Answers by Expert:

Ask Experts


TACTICS Detective Agency ((((((((((((((((((((((((((((((( BEST EXPERT ))))))))))))))))))))))))))))))


Ask a REAL Private investigator! Director of TACTICS Private Detectives and Investigations - and a Criminal Investigator. I maintain a leading group of Private Investigators and Detectives with substantial experience in: criminal defense, missing persons, surveillance, financial recovery, background checks, divorce investigations, insurance fraud, adoption, business intelligence, international matters, electronic countermeasures, drug abuse, and more. Author of The REAL Private Eye Handbook.


Resolved many very important and complicated investigations including kidnapping recovery, finding hidden assets in foreign countries, and assistance in the successful defense of wrongly accused criminal defendants. I maintain a very strong Federal Law Enforcement background with extensive training and education.

TACTICS Private Detectives

TACTICS Private Detectives

TACTICS Private Detectives

Awards and Honors
TACTICS Private Detectives

©2017 All rights reserved.