This document discusses the importance of properly collecting, documenting, and maintaining a chain of custody for any evidence gathered during an investigation. It notes that investigations may ultimately end up in civil or criminal court, so all evidence must be handled appropriately. It provides examples of documentation that should be used to track photographs, witness statements, and the collection and movement of physical evidence. Maintaining well-documented evidence is important both for potential legal proceedings and for conducting a thorough risk analysis after an incident.