Evidence Collection & Chain of Custody Flashcards

What is 'spoliation of evidence,' and what are its consequences in a security investigation?

Answer: The intentional or negligent destruction of evidence, which can result in legal sanctions and adverse inferences

Spoliation occurs when evidence is destroyed, altered, or concealed, and courts may draw adverse inferences or impose sanctions against the responsible party.

In which situation would a security investigator use a 'legal hold' notice?

Answer: When litigation is anticipated and relevant documents or evidence must be preserved

A legal hold (litigation hold) is issued to suspend normal document retention policies and ensure preservation of potentially relevant materials.

What is the significance of using tamper-evident seals on evidence containers?

Answer: They provide visible proof if unauthorized access to the evidence has occurred

Tamper-evident seals show any attempt to open or access the container, supporting the integrity of the chain of custody.

When collecting witness statements as evidence, a security investigator should ensure the statement is:

Answer: Signed and dated by the witness and the collecting investigator

A signed and dated witness statement provides authentication and creates a verifiable record that the witness provided the account at a specific time.

What does 'probative value' mean when evaluating evidence in a security investigation?

Answer: The degree to which the evidence tends to prove or disprove a fact at issue

Probative value measures how much an item of evidence actually helps establish or refute a material fact in the case.

Which of the following actions would compromise the chain of custody for a physical evidence item?

Answer: Leaving evidence unattended and unsecured without logging the gap in control

Any unrecorded period during which evidence is uncontrolled or unsecured creates a gap in the chain of custody that could be challenged.