Evidence Preservation & Chain of Custody Flashcards
7 cards from real CSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evidence Preservation & Chain of Custody flashcards as text
A court challenges the admissibility of video evidence because there is a 4-hour gap in the chain of custody records. What is the PRIMARY concern this raises?
Answer: The evidence may have been tampered with during the unaccounted period
An unaccounted gap raises the possibility that evidence was altered, accessed, or substituted, which undermines its integrity and admissibility.
Which of the following BEST describes a 'forensic image' of a hard drive?
Answer: A sector-by-sector duplicate that captures all data including deleted files
A forensic image is a bit-for-bit copy of the entire drive, preserving all data including deleted and slack space, for analysis without altering the original.
In evidence management, 'chain of custody' is BEST defined as:
Answer: A chronological documentation of who collected, handled, and transferred evidence
Chain of custody is the documented, unbroken sequence of possession and control that establishes evidence integrity from collection to courtroom.
A security manager wants to ensure that original surveillance footage is never analyzed directly. Which practice should be implemented?
Answer: Analyze only verified forensic copies while keeping the original sealed
Working only from verified forensic copies protects the original evidence from accidental modification during analysis.
Which of the following actions would MOST likely break the chain of custody for a USB drive containing surveillance footage?
Answer: Leaving the drive unattended and unsecured in an unlocked office overnight
Leaving evidence unsecured and unattended creates an unaccountable period where unauthorized access or tampering could occur.
What information is typically NOT required on a standard evidence label for physical surveillance media?
Answer: The officer's personal home address
An evidence label requires case-specific and officer-identification information, but personal home addresses are not standard and would be a privacy violation.
During a trial, the defense attorney argues that surveillance footage was not properly preserved. Which document would BEST refute this claim?
Answer: A complete, unbroken chain of custody log
An unbroken chain of custody log demonstrates documented, accountable handling from collection through trial, directly countering tampering allegations.