Evidence Collection & Chain of Custody Flashcards

What is the primary purpose of maintaining a 'chain of custody' for evidence in a security investigation?

Answer: To document every person who handled the evidence from collection to presentation

Chain of custody documentation proves that evidence has not been tampered with, altered, or contaminated between collection and use in proceedings.

When collecting physical evidence at a security incident scene, what should an investigator do first?

Answer: Document and photograph the scene before touching anything

Documenting and photographing the scene before collection preserves the original state of evidence and its spatial relationships.

Which type of evidence is considered 'best evidence' in a security investigation?

Answer: The original document or item, rather than a copy

The best evidence rule requires that the original document or item be presented rather than a duplicate, unless the original is unavailable.

What is 'transient evidence' in the context of physical security investigations?

Answer: Evidence that is temporary in nature and must be collected immediately

Transient evidence, such as odors, temperature, or melting materials, exists only briefly and must be documented or collected before it disappears.

In a security investigation, 'circumstantial evidence' differs from 'direct evidence' in that it:

Answer: Requires inference to connect it to a conclusion rather than proving it directly

Circumstantial evidence supports a conclusion through logical inference rather than directly demonstrating the fact in question.

When packaging physical evidence, why should each item be placed in a separate container?

Answer: To prevent cross-contamination between evidence items

Separate packaging prevents trace materials from one item contaminating another, which could compromise forensic analysis.