CSP Evidence Preservation & Chain of Custody 2 — Questions and Answers
Question 1: When a surveillance officer transfers digital video footage to an investigator, which action is MOST critical to maintaining chain of custody?
- Verbally confirming the transfer
- Completing a signed transfer log with date, time, and parties involved (Correct answer)
- Encrypting the footage before transfer
- Copying the footage to two separate drives
Correct answer: Completing a signed transfer log with date, time, and parties involved
A signed transfer log documenting the date, time, and identities of all parties creates the auditable record required for chain of custody integrity.
Question 2: A security officer discovers that a chain of custody form is missing one signature from an intermediate handler. What is the BEST course of action?
- Destroy and re-collect the evidence
- Document the gap, attempt to obtain the missing signature, and notify the supervisor (Correct answer)
- Continue without addressing the missing signature
- Create a new chain of custody form from scratch
Correct answer: Document the gap, attempt to obtain the missing signature, and notify the supervisor
Documenting the discrepancy, attempting to correct it, and notifying a supervisor preserves transparency and may salvage the evidence's admissibility.
Question 3: Which term describes the process of creating a unique digital fingerprint to verify that electronic evidence has not been altered?
- Encryption
- Hashing (Correct answer)
- Watermarking
- Compression
Correct answer: Hashing
Hashing (e.g., MD5 or SHA-256) generates a unique value for a file; any alteration changes the hash, proving tampering.
Question 4: In the context of evidence preservation, what does 'write protection' on a storage device prevent?
- Unauthorized viewing of footage
- Accidental or intentional modification of stored data (Correct answer)
- Physical damage to the device
- Duplication of the evidence
Correct answer: Accidental or intentional modification of stored data
Write protection blocks any new data from being written to the device, ensuring the original evidence remains unaltered.
Question 5: A chain of custody document should be started at which point in the evidence-handling process?
- When the evidence reaches the evidence room
- At the moment the evidence is first identified and collected (Correct answer)
- When the case goes to trial
- After the supervising investigator reviews the evidence
Correct answer: At the moment the evidence is first identified and collected
Chain of custody must begin at the moment of collection to account for the evidence from its very first point of contact.
Question 6: Which of the following is an example of 'spoliation' of evidence?
- Storing video footage in a locked evidence room
- Deliberately overwriting surveillance footage before it can be preserved (Correct answer)
- Creating a duplicate copy of a hard drive for analysis
- Logging each person who accesses an evidence bag
Correct answer: Deliberately overwriting surveillance footage before it can be preserved
Spoliation is the intentional or negligent destruction, alteration, or concealment of evidence relevant to a legal matter.
Question 7: When packaging physical evidence such as a memory card, why should anti-static bags be used?
- To prevent moisture damage
- To protect against electrostatic discharge that could corrupt stored data (Correct answer)
- To maintain a sterile environment for fingerprinting
- To comply with OSHA packaging standards
Correct answer: To protect against electrostatic discharge that could corrupt stored data
Electrostatic discharge (ESD) can corrupt or destroy data on electronic storage media, making anti-static packaging essential.
CSP Evidence Preservation & Chain of Custody 2
When a surveillance officer transfers digital video footage to an investigator, which action is MOST critical to maintaining chain of custody?