Evidence Preservation & Chain of Custody Flashcards
7 cards from real CSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evidence Preservation & Chain of Custody flashcards as text
A surveillance professional is asked to preserve footage from a networked video recorder (NVR). What is the FIRST step before exporting the footage?
Answer: Document the NVR's current date/time and compare it to a known accurate time source
Recording the NVR's internal clock and noting any discrepancy versus real time is essential for establishing accurate event timelines in any investigation.
Which of the following storage environments BEST protects physical digital evidence over a long period?
Answer: A climate-controlled, access-controlled evidence room with a sign-in log
A climate-controlled, access-controlled room with an access log provides the environmental stability and accountability necessary for long-term evidence integrity.
A tamper-evident seal on an evidence bag serves what PRIMARY purpose?
Answer: To provide visible indication if the bag has been opened after sealing
Tamper-evident seals leave a visible mark or void pattern if broken, providing immediate evidence of any unauthorized opening.
Under the Federal Rules of Evidence, electronically stored information (ESI) must meet what standard to be admissible?
Answer: It must be authentic, relevant, and its integrity must be verifiable
ESI admissibility requires demonstrating authenticity, relevance, and that its integrity can be verified through proper documentation such as chain of custody and hash values.
What is the purpose of using a 'write blocker' when duplicating evidence from a digital storage device?
Answer: To prevent any data from being written to the original evidence drive during duplication
A write blocker ensures that the forensic duplication process cannot accidentally write data to or alter the original evidence device.
Which scenario represents proper handling of evidence after an incident?
Answer: Exporting footage to a write-protected device, hashing it, and logging all subsequent access
Exporting to a write-protected device, computing a hash, and logging access creates a protected, verifiable copy with a complete audit trail.
If surveillance footage relevant to a pending lawsuit is inadvertently overwritten by the recording system's auto-loop function, the organization may face which legal consequence?
Answer: An adverse inference instruction, where the court may instruct the jury to assume the footage was unfavorable
Courts may issue an adverse inference (spoliation) instruction when relevant evidence is destroyed, allowing the jury to infer the lost evidence would have harmed the destroying party.