Evidence Export & Timestamping Flashcards
7 cards from real CST practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evidence Export & Timestamping flashcards as text
A surveillance technician exports footage using proprietary DVR software that requires a viewer application to play back. What is the key concern for legal proceedings?
Answer: The court may not have or accept the proprietary player, limiting accessibility
Proprietary formats require specific software to view, which may not be available to opposing counsel or the court, potentially challenging admissibility.
During evidence export, the technician notices the footage contains visible on-screen timestamp burns. Why is this still insufficient without additional documentation?
Answer: On-screen timestamps can be fabricated or reflect an uncalibrated internal clock
On-screen timestamps reflect the DVR's internal clock, which may be inaccurate, requiring external time verification and documentation of any discrepancy.
What is the purpose of exporting a slightly wider time window (e.g., 10 minutes before and after an incident) than strictly necessary?
Answer: To capture pre-incident and post-incident context that may be relevant
Exporting extra footage before and after an incident captures context such as suspect approach, escape routes, or witness behavior that may be critical.
Which action should a technician take FIRST when arriving to export evidence from a DVR at a crime scene?
Answer: Photograph the DVR display showing current date and time alongside a reference clock
Photographing the DVR clock display next to a reference clock immediately documents the time discrepancy before any changes occur.
An NVR exports footage in MP4 format. A colleague suggests converting it to AVI 'for compatibility.' What is the correct response?
Answer: Do not convert; transcode only a working copy and preserve the original MP4 as evidence
Converting recompresses the video, altering the original data; the original export must be preserved untouched while working copies can be transcoded.
When multiple cameras captured the same incident, what is the recommended export practice?
Answer: Export all relevant cameras together and document each camera's ID, location, and time offset
Exporting all relevant cameras with documented IDs, positions, and time offsets allows investigators to correlate multi-angle coverage of the incident.
What is a 'write blocker' and when is it used in surveillance evidence handling?
Answer: A hardware/software device that prevents writing to source media during forensic imaging
A write blocker is a forensic tool that allows reading from storage media while preventing any data from being written back, preserving original evidence.