Evidence Preservation & Chain of Custody Flashcards
7 cards from real CSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evidence Preservation & Chain of Custody flashcards as text
When a surveillance officer transfers digital video footage to an investigator, which action is MOST critical to maintaining chain of custody?
Answer: Completing a signed transfer log with date, time, and parties involved
A signed transfer log documenting the date, time, and identities of all parties creates the auditable record required for chain of custody integrity.
A security officer discovers that a chain of custody form is missing one signature from an intermediate handler. What is the BEST course of action?
Answer: Document the gap, attempt to obtain the missing signature, and notify the supervisor
Documenting the discrepancy, attempting to correct it, and notifying a supervisor preserves transparency and may salvage the evidence's admissibility.
Which term describes the process of creating a unique digital fingerprint to verify that electronic evidence has not been altered?
Answer: Hashing
Hashing (e.g., MD5 or SHA-256) generates a unique value for a file; any alteration changes the hash, proving tampering.
In the context of evidence preservation, what does 'write protection' on a storage device prevent?
Answer: Accidental or intentional modification of stored data
Write protection blocks any new data from being written to the device, ensuring the original evidence remains unaltered.
A chain of custody document should be started at which point in the evidence-handling process?
Answer: At the moment the evidence is first identified and collected
Chain of custody must begin at the moment of collection to account for the evidence from its very first point of contact.
Which of the following is an example of 'spoliation' of evidence?
Answer: Deliberately overwriting surveillance footage before it can be preserved
Spoliation is the intentional or negligent destruction, alteration, or concealment of evidence relevant to a legal matter.
When packaging physical evidence such as a memory card, why should anti-static bags be used?
Answer: To protect against electrostatic discharge that could corrupt stored data
Electrostatic discharge (ESD) can corrupt or destroy data on electronic storage media, making anti-static packaging essential.