Evidence Collection & Chain of Custody Flashcards

Which principle governs how long a CVA must retain collected case evidence after a verification assignment is closed?

Answer: Retention schedules established by the client contract, applicable law, or organizational policy

Evidence retention is governed by applicable laws, regulatory requirements, and contractual agreements, which vary by case type and jurisdiction.

When a CVA must collect evidence from a digital device, which action is MOST important to prevent alteration of the original data?

Answer: Use a write blocker to create a forensic image without modifying the source device

A write blocker prevents any data from being written to the source device during imaging, ensuring the original digital evidence remains unaltered.

What is the significance of 'best evidence rule' for a CVA submitting evidence in a formal proceeding?

Answer: The original document is preferred over a copy unless the original is unavailable

The best evidence rule requires that the original version of a document be produced when proving its content, with copies allowed only when the original is unavailable or its production is excused.

A CVA receives a tip from a confidential informant that leads to key evidence. How should the informant's identity be handled in documentation?

Answer: The identity should be protected per confidentiality agreements while the evidence itself is documented

Confidential informant identities are protected through confidentiality protocols, but the evidence derived from the tip must still be properly collected, authenticated, and documented.

Which of the following scenarios represents a break in the chain of custody?

Answer: Evidence is left unattended on an agent's desk for two days without logging

Leaving evidence unattended and unlogged for an extended period breaks the chain of custody because there is no verifiable record of who had access or whether the evidence was altered during that time.

In verification assignments involving financial records, why is it important to collect and preserve original bank statements rather than relying solely on screenshots?

Answer: Original statements are harder to dispute because they can be authenticated directly with the issuing institution

Original bank statements can be authenticated by contacting the issuing institution, making them far more defensible than screenshots which can be easily manipulated.

A CVA is asked by a client to destroy evidence collected during a closed case. The agent should FIRST:

Answer: Verify that destruction complies with applicable legal holds, regulatory requirements, and contractual obligations before proceeding

Before destroying case evidence, the agent must confirm there are no active legal holds, pending litigation, regulatory requirements, or contractual terms that prohibit destruction.