In the Certified Fraud Examiner (CFE) discipline, collecting evidence is central to building a defensible fraud case, and understanding the types of evidence helps examiners gather, preserve, and present information that will withstand legal scrutiny. Evidence is generally classified in several ways. First, direct evidence proves a fact without requiring inference, such as a confession or an eyewitness account of a fraudulent transaction. Circumstantial evidence, by contrast, requires the fact-finder to draw an inference; most fraud cases rely heavily on circumstantial evidence, like unexplained wealth or altered records, because perpetrators rarely leave direct proof. Second, evidence can be categorized by form. Testimonial evidence consists of statements from witnesses, suspects, or experts, obtained through interviews, depositions, or courtroom testimony. Documentary evidence includes written or recorded materials such as invoices, bank statements, emails, contracts, and electronic data; this is often the backbone of fraud examinations and must be authenticated to be admissible. Physical (or real) evidence refers to tangible objects, like forged checks, computers, or seized property. Demonstrative evidence, such as charts, timelines, and summaries, illustrates or clarifies other evidence for a judge or jury. Third, examiners distinguish between relevant and material evidence (information that tends to prove or disprove a fact at issue) and must be mindful of rules governing hearsay, privilege, and the best evidence rule, which favors original documents. Electronic or digital evidence has become especially important, requiring forensic imaging, hash verification, and careful handling to preserve integrity. Regardless of type, CFEs must maintain a documented chain of custody, recording who handled each item, when, and why, to demonstrate that evidence has not been altered. They should also gather evidence lawfully, respecting privacy and employment laws, so that it remains admissible. Mastering these categories enables fraud examiners to organize investigations logically, corroborate findings through multiple evidence types, and present a compelling, credible case.

In the CFE framework, Collecting, Storing and Disposing of Evidence is a critical component of fraud examination because the value of evidence depends on its integrity and admissibility. Collecting evidence begins with identifying what items are relevant to the allegation—documents, electronic data, physical objects, or statements. Examiners must obtain evidence lawfully, respecting privacy rights, employment policies, and legal authority such as subpoenas or consent. Each item should be collected in a way that preserves its original condition; for example, documents should be handled minimally, electronic data should be forensically imaged rather than copied casually, and the date, time, source, and person collecting the item must be recorded. Establishing and maintaining the chain of custody is essential: every transfer of evidence must be documented so the examiner can prove the item has not been altered, substituted, or tampered with. Storing evidence requires a secure, controlled environment with restricted access. Physical evidence is typically placed in sealed, labeled containers or evidence bags and kept in locked cabinets or rooms, while electronic evidence is stored on write-protected media with hash values recorded to verify integrity. Environmental factors such as heat, moisture, and magnetic fields must be considered to prevent degradation. Access logs should record who handled the evidence and when. Original documents are preserved, and working copies are used for analysis to avoid damaging originals. Disposing of evidence occurs only after the matter is fully resolved, including any appeals, and in accordance with legal retention requirements, organizational policies, and court orders. Disposal should be documented, authorized by appropriate parties, and carried out securely—through shredding, degaussing, or certified destruction—so sensitive information is not exposed. Returning evidence to its rightful owner may also be required. Throughout the process, meticulous documentation protects the examiner, supports the credibility of findings, and ensures the evidence can withstand scrutiny in legal proceedings.

In the Certified Fraud Examiner (CFE) framework, collecting evidence is a critical phase of a fraud examination, and the methods used to obtain it must be lawful, ethical, and well documented so the evidence remains admissible and credible. Fraud examiners typically rely on several principal methods. First, document examination involves gathering and analyzing records such as invoices, bank statements, contracts, emails, ledgers, and electronic files. Documents are often the backbone of a fraud case because they establish a paper trail and corroborate or refute testimony. Second, interviews and interrogations are used to obtain testimonial evidence from witnesses, co-workers, third parties, and ultimately the suspect. Interviews should progress from neutral witnesses toward the target, be conducted by trained personnel, and be carefully recorded through notes or signed statements. Third, observation and surveillance, including covert physical surveillance, fixed-point monitoring, and video or electronic monitoring, can capture behavior and verify allegations, though legal limits on privacy must be respected. Fourth, public records searches and database research draw on court filings, corporate registrations, property records, licensing data, and social media to build background profiles, trace assets, and identify undisclosed relationships or conflicts of interest. Fifth, digital forensics involves imaging computers, mobile devices, and servers to recover deleted data, metadata, and communications while preserving the original media. Sixth, financial and analytical techniques such as data mining, ratio analysis, Benford's Law testing, and net worth or bank deposit analysis help detect anomalies and quantify losses. Finally, informants, hotline tips, and confidential sources frequently initiate examinations and point investigators toward relevant evidence. Across all methods, the examiner must maintain a strict chain of custody, obtain proper legal authority (consent, subpoenas, search warrants, or court orders), avoid entrapment or unauthorized access, and document every step. Properly obtained evidence not only supports disciplinary or legal action but also protects the organization and examiner from liability.

In the Certified Fraud Examiner (CFE) context, collecting evidence from electronic sources involves two related but distinct disciplines: digital forensics and e-discovery. Understanding the difference matters because each has its own purpose, methodology, legal standards, and practitioners.

Digital forensics is the scientific identification, preservation, acquisition, analysis, and reporting of data stored on electronic devices such as computers, servers, mobile phones, and storage media. Its goal is to uncover what happened, when, how, and by whom. Forensic examiners create bit-by-bit forensic images of media, verify integrity with hash values (e.g., MD5 or SHA-256), and work only on copies to protect the original. They can recover deleted files, examine metadata, analyze system logs, reconstruct user activity, and detect anti-forensic efforts like wiping or timestamp manipulation. Digital forensics is investigative in nature and requires specialized tools (EnCase, FTK, Cellebrite) and trained specialists whose findings may be presented as expert testimony. Chain of custody and strict documentation are essential because the evidence must withstand courtroom scrutiny.

E-discovery (electronic discovery), by contrast, is the legal process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information (ESI) in response to litigation, regulatory requests, or investigations. It is governed by procedural rules such as the U.S. Federal Rules of Civil Procedure and follows frameworks like the Electronic Discovery Reference Model (EDRM). E-discovery focuses on active, accessible data—emails, documents, spreadsheets, chat messages—and emphasizes relevance, privilege review, deduplication, keyword searching, and defensible production to opposing parties. It is typically managed by attorneys, paralegals, and litigation-support vendors.

For a CFE, the key distinction is this: digital forensics asks "what does the evidence reveal about the fraud?" and can recover hidden or deleted data, while e-discovery asks "what existing information must be preserved and produced?" Both require legal holds, preservation, and sound chain of custody. In practice, fraud examinations often use both—forensics to investigate wrongdoing and e-discovery to manage the volume of ESI required for legal proceedings.

In Certified Fraud Examiner (CFE) practice, collecting evidence from digital sources requires understanding volatility—the degree to which data is at risk of being altered or lost. Volatility directly shapes the sequence and methods a fraud examiner uses during digital evidence collection.

Volatile data exists only temporarily, typically in a system's working memory. It includes contents of RAM, running processes, open network connections, logged-in users, cached passwords, encryption keys, clipboard contents, and temporary files. When a device is powered off or rebooted, this information is destroyed. Non-volatile data, by contrast, persists on storage media such as hard drives, solid-state drives, USB devices, backup tapes, and cloud repositories.

The guiding principle is the 'order of volatility': collect the most perishable evidence first. A commonly accepted sequence is: (1) registers and cache, (2) memory and routing tables, (3) running processes and network state, (4) temporary file systems, (5) hard disk contents, (6) remote logs and monitoring data, and (7) archival or backup media. Following this order prevents inadvertent loss of critical evidence, such as a fraudster's active remote session or an unencrypted key that unlocks concealed files.

Fraud examiners must also recognize that the act of collection can itself alter evidence. Live acquisition tools should be run from trusted, external media, and every action must be documented with timestamps and justification. Before powering down a system, examiners weigh whether disk encryption or anti-forensic tools could render data inaccessible once the machine is off.

For non-volatile media, examiners create forensically sound, bit-for-bit images using write blockers and verify integrity with hash values (MD5, SHA-256). Working copies are analyzed while originals remain preserved.

Throughout, maintaining chain of custody is essential: who collected the evidence, when, where, how it was secured, and every transfer. Proper handling of volatility ensures evidence remains authentic, complete, and admissible, supporting the examiner's conclusions in disciplinary, civil, or criminal proceedings.

In the CFE Collecting Evidence domain, digital evidence is not confined to a suspect's primary computer. Fraud examiners must recognize that critical data often resides on peripheral devices, portable media, and cloud storage, each presenting distinct collection and preservation challenges.

Peripheral devices include printers, scanners, copiers, fax machines, external monitors, keyboards, and smart devices connected to a system. Many modern printers and copiers contain internal hard drives that retain images of documents processed, which can reveal altered invoices, forged checks, or confidential data exfiltration. Examiners should inventory all peripherals during a seizure and consider whether they store data.

Portable storage covers USB flash drives, external hard drives, memory cards, optical discs, smartphones, tablets, and laptops. Because these devices are small and easily concealed or destroyed, examiners must search thoroughly and secure them promptly. Chain of custody must be documented from the moment of collection, including device identifiers, serial numbers, and condition. Forensic imaging using write-blockers ensures the original data remains unaltered, and hash values verify integrity. Mobile devices require special handling, such as placing them in Faraday bags to prevent remote wiping.

Cloud storage involves data hosted by third-party providers such as Google Drive, Dropbox, Microsoft OneDrive, or enterprise SaaS platforms. This evidence raises jurisdictional and legal access issues because servers may be located in multiple countries. Examiners typically cannot seize cloud data directly; instead they must obtain credentials with proper authority, issue preservation letters to providers, or secure subpoenas, court orders, or warrants. Timing is critical because cloud data can be modified or deleted remotely by the subject. Metadata, access logs, and version histories available from providers can establish who accessed or altered documents and when.

Across all three categories, CFEs must act within legal authority, maintain strict chain of custody, use forensically sound methods, and document every step to ensure evidence is admissible and credible.

In the Certified Fraud Examiner (CFE) framework, collecting digital evidence follows a structured, defensible process so that electronic data can withstand legal scrutiny. The digital evidence investigation is typically divided into several phases:

1. Planning and Preparation: Before touching any device, the examiner defines the scope of the investigation, identifies potential sources of digital evidence (computers, servers, mobile devices, cloud accounts, email systems, network logs), and ensures proper legal authority exists—such as consent, company policy, subpoena, or search warrant. The team assembles appropriate tools, write blockers, and documentation templates, and considers privacy, employment, and jurisdictional issues.

2. Identification: The examiner locates and recognizes relevant electronic evidence. This includes understanding where data resides (hard drives, removable media, backups, volatile memory) and determining which items are material to the fraud allegation.

3. Preservation and Collection: Evidence must be secured to prevent alteration or destruction. Forensic images (bit-by-bit copies) are created using write-blocking hardware, and hash values (e.g., MD5, SHA-256) are generated to verify integrity. Volatile data such as RAM may be captured first. A detailed chain of custody is initiated, recording who handled the evidence, when, where, and why. Original media is stored securely, and all work is performed on copies.

4. Examination and Analysis: Using forensic software, the examiner recovers deleted files, examines metadata, reviews internet history, emails, and logs, and searches for keywords or patterns relevant to the fraud scheme. Analysis seeks to reconstruct events, establish timelines, and link activity to specific individuals.

5. Documentation and Reporting: Every step is contemporaneously documented. The final report summarizes methodology, findings, and conclusions in clear, objective language understandable to non-technical readers, such as attorneys, management, or juries.

6. Presentation and Testimony: The examiner may present findings in court or administrative proceedings, explaining procedures and defending the integrity and admissibility of the evidence.

Following these phases ensures digital evidence remains authentic, reliable, and legally admissible.