CSP Evidence Preservation & Chain of Custody 3

Question 1

A court challenges the admissibility of video evidence because there is a 4-hour gap in the chain of custody records. What is the PRIMARY concern this raises?

Accepted Answer

The evidence may have been tampered with during the unaccounted period

Answer

An unaccounted gap raises the possibility that evidence was altered, accessed, or substituted, which undermines its integrity and admissibility.

Question 2

Which of the following BEST describes a 'forensic image' of a hard drive?

Accepted Answer

A sector-by-sector duplicate that captures all data including deleted files

Answer

A forensic image is a bit-for-bit copy of the entire drive, preserving all data including deleted and slack space, for analysis without altering the original.

Question 3

In evidence management, 'chain of custody' is BEST defined as:

Accepted Answer

A chronological documentation of who collected, handled, and transferred evidence

Answer

Chain of custody is the documented, unbroken sequence of possession and control that establishes evidence integrity from collection to courtroom.

Question 4

A security manager wants to ensure that original surveillance footage is never analyzed directly. Which practice should be implemented?

Accepted Answer

Analyze only verified forensic copies while keeping the original sealed

Answer

Working only from verified forensic copies protects the original evidence from accidental modification during analysis.

Question 5

Which of the following actions would MOST likely break the chain of custody for a USB drive containing surveillance footage?

Accepted Answer

Leaving the drive unattended and unsecured in an unlocked office overnight

Answer

Leaving evidence unsecured and unattended creates an unaccountable period where unauthorized access or tampering could occur.

(CSP) Certified Surveillance Professional Practice Test

(CSP) Certified Surveillance Professional Practice Test

CSP Evidence Preservation & Chain of Custody 3