CST Evidence Export & Timestamping 2 — Questions and Answers
Question 1: When exporting video evidence for court, which file attribute is most critical to preserve to demonstrate the footage has not been altered?
- File size in bytes
- Cryptographic hash value (MD5/SHA) (Correct answer)
- File creation date on the export drive
- Video resolution metadata
Correct answer: Cryptographic hash value (MD5/SHA)
A cryptographic hash value (MD5 or SHA) provides a verifiable fingerprint proving the exported file is bit-for-bit identical to the original.
Question 2: A DVR's internal clock drifts 4 minutes fast over a month. When exporting footage for an incident that occurred at 2:15 PM, what timestamp should be noted in the chain of custody?
- 2:15 PM as displayed on the DVR
- 2:11 PM after subtracting the clock drift (Correct answer)
- 2:19 PM after adding the clock drift
- The timestamp cannot be used and footage is inadmissible
Correct answer: 2:11 PM after subtracting the clock drift
The corrected time (2:11 PM) should be documented alongside the displayed DVR time, with the clock discrepancy noted in the chain of custody.
Question 3: Which export method best preserves original video evidence integrity compared to screen-capture recording?
- Re-encoding to H.264 at a lower bitrate
- Native format export directly from the DVR/NVR (Correct answer)
- Converting to AVI using third-party software
- Taking sequential screenshots at 1-second intervals
Correct answer: Native format export directly from the DVR/NVR
Native format export preserves the original encoded data without recompression or quality loss, maintaining evidentiary integrity.
Question 4: An investigator needs to verify the NVR system clock is accurate before exporting evidence. What is the most reliable reference source for time verification?
- The investigator's personal wristwatch
- An NTP-synchronized server or GPS time source (Correct answer)
- Another DVR on the same network
- The computer used to view the footage
Correct answer: An NTP-synchronized server or GPS time source
NTP-synchronized or GPS time sources provide authoritative, traceable time references accepted as accurate in legal proceedings.
Question 5: What document must accompany exported video evidence to maintain admissibility throughout its custody lifecycle?
- A warranty certificate for the recording equipment
- A chain of custody form signed by each person who handled the evidence (Correct answer)
- A manufacturer's spec sheet for the DVR
- An insurance policy for the storage media
Correct answer: A chain of custody form signed by each person who handled the evidence
A chain of custody form documents every transfer and handling of evidence, establishing an unbroken record required for court admissibility.
Question 6: Which storage media is generally preferred for long-term archival of exported surveillance video evidence?
- USB flash drives (thumb drives)
- Rewritable DVD-RW discs
- Write-once optical media (DVD-R, BD-R) or WORM drives (Correct answer)
- Standard magnetic hard drives
Correct answer: Write-once optical media (DVD-R, BD-R) or WORM drives
Write-once media physically prevents overwriting, providing tamper-evident storage that strengthens the case for unaltered evidence.
Question 7: When documenting a clock discrepancy during evidence export, which details must be recorded?
- Only the correct real-world time
- Only the DVR-displayed time
- Both the DVR-displayed time and the verified real-world time, plus how discrepancy was measured (Correct answer)
- The discrepancy in milliseconds only
Correct answer: Both the DVR-displayed time and the verified real-world time, plus how discrepancy was measured
Full documentation requires recording both times and the measurement method so investigators and courts can reconstruct the true event timeline.
CST Evidence Export & Timestamping 2
When exporting video evidence for court, which file attribute is most critical to preserve to demonstrate the footage has not been altered?