After a malfunction, which action helps ensure evidence integrity?

• A. Destroy evidence to prevent misuse.
• B. Delay any documentation until a later time.
• C. Replace with a new device but do not document.
• D. Secure evidence by preserving the expended canister and documenting device details.

Answer: (D)

Maintaining evidence integrity means keeping a clear, unaltered trail of what happened and what was involved. After a malfunction, the best action is to secure the evidence by preserving the expended canister and documenting device details. Keeping the used canister intact provides the physical artifact investigators may analyze for residue, seals, or other indications of how the device behaved. Recording device details—such as model, lot/serial numbers, expiration date, and the exact time and circumstances of the malfunction—creates a verifiable chain of custody and helps determine whether the issue was due to manufacturing, a defect, or user handling.

Destroying evidence eliminates any chance to review what occurred and can imply tampering. Delaying documentation creates gaps that undermine the accuracy of the incident record and can hinder investigation or accountability. Replacing the device without documentation loses essential traceability, making it difficult to assess the malfunction and prevents proper reporting.