A process of modifying workflows associated with processing an incident scene in response to detecting contamination of the incident scene. An electronic computing device obtains a first image of an incident scene at a first point in time and analyzes the first image to detect a state of evidentiary items present at the incident scene. The device obtains a second image of the incident scene at a second point in time and detects a change in the state of the evidentiary items based on a comparison of the first and second images. When it is determined that one or more persons entered or exited the incident scene during a time period between the first point in time and the second point in time, the device detects that the incident scene has been contaminated and generates a workflow modification identifying one or more actions for execution by a workflow server.