Investigating sexual assault: evidence, forensic examinations and digital evidence

Detective Sergeant Carla Mendes visits the class for this lesson. She has led the Port Ardent department's intimate partner violence and sexual assault unit for four years and investigated sexual offenses for eleven. She puts a single sentence on the screen: 'Consent cases are won on capacity and context, not on DNA.' She explains. 'In most sexual assaults by someone the victim knows, the accused will not deny that sexual activity happened. He will say it was consensual. The DNA proves contact. It says nothing about consent. So the investigation has to be about everything around the act: what condition she was in, what he saw, what he said, what others saw, and what happened afterward.'

This lesson covers how sexual assault investigations gather that evidence: forensic medical examinations, physical and scene evidence, toxicology, DNA, digital evidence and witnesses, and how investigators approach the suspect. It also looks at what happened when police services discovered that many sexual assault reports were being closed without proper investigation.

The forensic medical examination

A victim of a recent sexual assault should be offered a forensic medical examination as soon as possible. The examination has two purposes, and the first is always health: treatment of injuries, testing and preventive treatment for sexually transmitted infections and HIV, emergency contraception, and assessment of any strangulation or head injury. The second is evidence: documenting injuries, collecting swabs and samples that may contain the offender's DNA, collecting clothing, and collecting samples for toxicology if drugs or alcohol may have been involved. Examinations are done by specially trained nurses and physicians, and the victim can decline any part of them.

In Ohio, examinations are performed by sexual assault nurse examiners, known as SANEs, and other trained providers at hospitals. Federal law, through the Violence Against Women Act, requires states to ensure victims can receive a forensic examination free of charge whether or not they report to police, and Ohio pays for examinations through a fund administered by the Attorney General. Hospitals usually collect evidence within about five days of an assault. Since 2015, Ohio law has required law enforcement agencies to submit kits to a crime laboratory within thirty days after receiving them, and a 2023 law created a statewide tracking system that lets victims follow the status of their kit and gives them rights to information about testing, results and destruction dates. Investigators should never pressure a victim to have an examination for the sake of the case, but they should make sure the victim knows that the window for some evidence is limited.

# Hours elapsed since the assault and typical evidence windows (illustrative; hospitals and labs vary)
from datetime import datetime
assault = datetime(2026, 3, 8, 2, 30)     # estimated from witness and phone evidence
exam    = datetime(2026, 3, 10, 16, 30)   # forensic examination began
hours = (exam - assault).total_seconds() / 3600
windows = {"blood alcohol": 12, "most drugs in urine": 96, "DNA swabs (typical)": 120, "some DNA evidence (extended)": 288}
print(f"hours elapsed: {hours:.0f}")
for item, limit in windows.items():
    print(f"{item:30} window about {limit:3d} h -> {'within' if hours <= limit else 'past'}")

hours elapsed: 62
blood alcohol                  window about  12 h -> past
most drugs in urine            window about  96 h -> within
DNA swabs (typical)            window about 120 h -> within
some DNA evidence (extended)   window about 288 h -> within

Sofia's examination at Port Ardent General Hospital began sixty-two hours after the estimated time of the assault. As the example shows, it was well within the usual window for DNA evidence, but too late for a meaningful blood alcohol result, and close to the end of the window for detecting many drugs in urine. The toxicology screen found no drugs. Mendes explains that this did not mean no drug was given, only that it could not be detected, and that the case was investigated as one of severe voluntary intoxication, which is far more common than covert drugging.

Toxicology and drug-facilitated sexual assault

Alcohol is by far the substance most often involved in sexual assaults. Covert drugging with substances such as GHB or certain sedatives does occur, but it is less common than media coverage suggests, and many of the drugs involved leave the body quickly; some can be detected in urine only for hours. When a victim describes symptoms out of proportion to what they drank, sudden loss of memory, or waking in a different place with no memory of getting there, investigators should arrange collection of urine and blood as soon as possible, ideally the first urine passed after the assault, even before the victim decides whether to report. Toxicology results must be interpreted by a qualified toxicologist, and a negative result never rules out impairment. Evidence of how much the victim drank, how they behaved, what witnesses saw, and what video shows is usually more important than the laboratory result.

DNA and physical evidence

DNA evidence from swabs, clothing and bedding can confirm that sexual contact occurred and can identify an unknown offender through the national DNA databases, the Combined DNA Index System, known as CODIS, in the United States. When the suspect is known, police usually need a search warrant or the suspect's consent to obtain a DNA sample for comparison, although Ohio law also requires DNA samples to be taken from people arrested for felonies. Physical evidence at the scene, such as bedding, towels, clothing and condoms, should be seized under a warrant as soon as possible, before it is washed or discarded, and the scene photographed. Mendes obtained a warrant for the Lakeview Avenue house on March 12. The sheets on Brandon's bed had not been changed, and they were seized along with a towel.

In the Reyes case, swabs from the examination yielded a male DNA profile. On April 14, Mendes obtained a search warrant for a buccal swab from Brandon, whose lawyer had told police he would not provide a sample voluntarily. His DNA matched the profile. Mendes reminds the class of her sentence on the screen: the match proved what Brandon's own message had already suggested, that sexual activity took place. The real question was Sofia's capacity, and what Brandon knew about it.

Witnesses and context

Witnesses in acquaintance sexual assault cases are often the victim's and the suspect's friends and acquaintances, who may have divided loyalties, may have talked to each other, and may have been drinking. They should be identified quickly and interviewed separately, as soon as possible, before their memories are shaped by conversation and social media. Investigators should ask what each witness saw and heard directly, and should distinguish that from what they were told. Useful questions focus on observable signs of intoxication, such as slurred speech, stumbling, vomiting, being unable to stand or falling asleep, and on what the suspect said and did, especially any comment about the victim's condition.

Mendes interviewed eleven people who had been at the party. Maya described Sofia at half past one as 'barely able to stand' and said she told Brandon that Sofia needed to go home. A roommate, Liam Chen, said that at about quarter to two he saw Brandon 'half-carrying' Sofia up the stairs, with her feet 'dragging on a couple of steps,' and that Brandon said, 'She's fine, she just needs to lie down.' Two other guests described Sofia as 'really drunk' earlier in the night. A doorbell camera across the street showed Maya leaving at 2:01 a.m. and Sofia leaving at 6:07 a.m., walking unsteadily and holding the railing. None of the witnesses had seen what happened in the room. But together they gave a clear picture of Sofia's condition and of what Brandon had seen.

Digital evidence

Digital evidence is now central to almost every sexual and intimate partner violence investigation: messages between the victim and the suspect, messages with friends before and after, social media posts, photographs and videos, location data, rideshare and payment records, and search histories. Investigators must obtain this evidence lawfully and with respect for privacy. Searching a suspect's phone requires a warrant; in Riley v. California (2014), the Supreme Court of the United States held that police generally may not search a cell phone seized incident to arrest without one, and in Carpenter v. United States (2018) it held that police need a warrant to obtain historical cell-site location records. Records held by companies, such as subscriber information and stored messages, are obtained through preservation requests, subpoenas, court orders and warrants, depending on the information.

Victims are often asked to provide their own phones, and many are reluctant, because they fear that everything on the phone will be examined and shared. Investigators should explain what they need and why, ask for consent to a focused extraction limited by date range and type of data, document the scope of the consent, and never take more than is needed. Sofia agreed to an extraction limited to her messages and photographs from 6 p.m. on March 7 to midnight on March 8. That extraction recovered the unsent draft to Maya created at 2:14 a.m. and Brandon's 11:42 message. After Brandon's arrest on April 21, a warrant to search his phone found that at 10:58 a.m. on March 8 he had searched online for whether a person could get in trouble if a girl was drunk. Mendes said that search, made an hour before his message to Sofia, was some of the most important evidence in the case.

Investigators sometimes ask a victim to contact the suspect while police record the conversation, in the hope that the suspect will make admissions. Ohio is a one-party consent state under its wiretap statute, so a call recorded with the victim's consent, at police direction, is lawful without a warrant, although agency policy and the victim's wellbeing should govern whether to ask. Mendes raised the possibility with Sofia, who said she could not face speaking to him. Mendes told her that was entirely her decision and did not raise it again. 'A pretext call is a tool,' she says. 'It is never worth retraumatizing someone who has told you no.'

The suspect

Suspects in sexual assault cases should be interviewed after the investigator has gathered as much of the other evidence as possible, so that the interview can test the suspect's account against it. The interview must respect the suspect's rights: Miranda warnings and the right to counsel where the suspect is in custody, and the right to remain silent. Many suspects in acquaintance cases decline to be interviewed on their lawyer's advice. Brandon's lawyer told Mendes in late March that his client would not be giving a statement. Mendes says that was entirely his right, and that the case did not need his statement because it had his messages, his search history, his roommate's account and his own words to Maya.

Unfounded cases and case review

In 2017, a twenty-month investigation by The Globe and Mail newspaper, titled 'Unfounded,' found that Canadian police services were closing about one in five sexual assault allegations as unfounded, meaning the police had concluded that no offense occurred or was attempted, and that rates varied widely between services in ways that could not be explained by differences in the cases. Many of the files had been closed without a full investigation, sometimes after a single interview, and sometimes on the basis of myths about how victims behave. Similar problems had been found in the United States, most notably in Philadelphia, where a 1999 newspaper investigation revealed that police had buried thousands of sexual assault reports. Philadelphia responded in 2000 by inviting advocates to review closed sexual assault files every year, an approach now called the Philadelphia model, and it has since been adopted in many American and Canadian jurisdictions. Mendes's unit takes part in an annual external review, and she tells the class that the reviewers have made her a better investigator. 'They ask the questions I should have asked. Why was this file closed? What did we not do?'

Desjardins ends with a point about classification. A file should be classified as unfounded only when the investigation establishes that the offense did not happen or was not attempted. A case in which the evidence is not strong enough to charge is not unfounded; it is unresolved, and it should be classified that way. The difference matters to victims, who may later learn how their report was recorded, and to the integrity of the statistics that policy is based on.