CSP Evidence Preservation & Chain of Custody 3 — Questions and Answers
Question 1: A court challenges the admissibility of video evidence because there is a 4-hour gap in the chain of custody records. What is the PRIMARY concern this raises?
- The footage may have been recorded at the wrong resolution
- The evidence may have been tampered with during the unaccounted period (Correct answer)
- The storage device lacks proper labeling
- The officer who collected it was not certified
Correct answer: The evidence may have been tampered with during the unaccounted period
An unaccounted gap raises the possibility that evidence was altered, accessed, or substituted, which undermines its integrity and admissibility.
Question 2: Which of the following BEST describes a 'forensic image' of a hard drive?
- A photograph of the hard drive's physical exterior
- A sector-by-sector duplicate that captures all data including deleted files (Correct answer)
- A compressed backup of only active files
- A log of all files recently accessed on the drive
Correct answer: A sector-by-sector duplicate that captures all data including deleted files
A forensic image is a bit-for-bit copy of the entire drive, preserving all data including deleted and slack space, for analysis without altering the original.
Question 3: In evidence management, 'chain of custody' is BEST defined as:
- The physical chain used to secure evidence lockers
- A chronological documentation of who collected, handled, and transferred evidence (Correct answer)
- The legal process for admitting evidence in court
- A record of all surveillance cameras in a facility
Correct answer: A chronological documentation of who collected, handled, and transferred evidence
Chain of custody is the documented, unbroken sequence of possession and control that establishes evidence integrity from collection to courtroom.
Question 4: A security manager wants to ensure that original surveillance footage is never analyzed directly. Which practice should be implemented?
- Store originals in a public archive
- Analyze only verified forensic copies while keeping the original sealed (Correct answer)
- Compress the original to save storage space before analysis
- Allow only one analyst to view the original
Correct answer: Analyze only verified forensic copies while keeping the original sealed
Working only from verified forensic copies protects the original evidence from accidental modification during analysis.
Question 5: Which of the following actions would MOST likely break the chain of custody for a USB drive containing surveillance footage?
- Hashing the drive before and after transfer
- Leaving the drive unattended and unsecured in an unlocked office overnight (Correct answer)
- Logging the drive into the evidence management system
- Placing the drive in a tamper-evident bag
Correct answer: Leaving the drive unattended and unsecured in an unlocked office overnight
Leaving evidence unsecured and unattended creates an unaccountable period where unauthorized access or tampering could occur.
Question 6: What information is typically NOT required on a standard evidence label for physical surveillance media?
- Date and time of collection
- Name and badge number of the collecting officer
- The officer's personal home address (Correct answer)
- Case or incident number
Correct answer: The officer's personal home address
An evidence label requires case-specific and officer-identification information, but personal home addresses are not standard and would be a privacy violation.
Question 7: During a trial, the defense attorney argues that surveillance footage was not properly preserved. Which document would BEST refute this claim?
- The camera's technical specification sheet
- A complete, unbroken chain of custody log (Correct answer)
- The facility's security policy manual
- The surveillance system's maintenance record
Correct answer: A complete, unbroken chain of custody log
An unbroken chain of custody log demonstrates documented, accountable handling from collection through trial, directly countering tampering allegations.
CSP Evidence Preservation & Chain of Custody 3
A court challenges the admissibility of video evidence because there is a 4-hour gap in the chain of custody records.
What is the PRIMARY concern this raises?