Evidence Preservation & Chain of Custody Flashcards

A surveillance investigator is required to testify about video evidence. Which statement BEST demonstrates proper evidence handling?

Answer: 'I exported the footage, computed a hash value, and documented every subsequent access in the chain of custody log.'

Exporting footage, computing a hash, and maintaining a chain of custody log demonstrates all best practices for evidence integrity and accountability.

When multiple officers respond to an incident and each handles the same piece of evidence, what practice BEST maintains chain of custody?

Answer: Each officer signs and dates the chain of custody form at each transfer point

Every individual who handles evidence must sign the chain of custody form at each transfer, creating a complete, verifiable record of possession.

Which of the following is a recommended practice for preserving video evidence stored in cloud-based surveillance systems?

Answer: Downloading and locally archiving footage with hash verification before any automatic deletion occurs

Cloud providers may automatically delete footage after a set retention period, so downloading and hashing a local copy ensures evidence is preserved under investigator control.

In evidence documentation, the term 'custodian of record' refers to:

Answer: The person or entity responsible for maintaining and producing records when legally required

The custodian of record is the designated individual or organization legally responsible for maintaining records and producing them in response to subpoenas or court orders.

A surveillance officer exports incident footage to a DVD and seals it in a tamper-evident envelope. Three weeks later, the seal appears broken when retrieved from the evidence room. What should the officer do FIRST?

Answer: Document the condition immediately, notify the supervisor, and initiate an internal investigation

Discovering a compromised seal requires immediate documentation and escalation so that the integrity issue is on record and can be investigated.

Which hash algorithm is currently recommended for forensic evidence integrity verification due to its resistance to collision attacks?

Answer: SHA-256

SHA-256 is the current forensic standard because known collision vulnerabilities have been found in MD5 and SHA-1, making them less reliable for evidence integrity.

A chain of custody log entry should include which of the following when transferring evidence between personnel?

Answer: The names and signatures of both the transferring and receiving parties, along with date and time

A valid transfer entry must identify both parties, with signatures confirming the handoff, and must be timestamped to establish an accurate timeline.