Examkin

Question

Difficulty: HardIncident Response and Chain of Custody

During an internal investigation into suspicious data transfers, an IT support specialist is sent to secure a compromised workstation in an empty office suite. The specialist disconnects the workstation's network cable, powers down the system, attaches an evidence label with the serial number, and seals the unit in a container. However, before handing the equipment over to the legal forensics team the next morning, the specialist leaves the sealed container in an unlocked office cubicle overnight without logging storage location updates or transfer signatures. Which of the following best explains why this evidence may be rendered legally inadmissible?

  1. The specialist failed to maintain an unbroken record of physical custody and secure storage control overnight.Answer
  2. B
    Powering down the system automatically invalidates the cryptographic integrity hash of the local storage drive.
  3. C
    Standard sealed containers fail to meet physical security standards because they lack active electromagnetic pulse shielding.
  4. D
    The incident was misclassified as an internal investigation rather than a network breach requiring immediate cloud partition isolation.

Answer

The specialist failed to maintain an unbroken record of physical custody and secure storage control overnight.
Chain of custody protocols require a continuous, verifiable, and documented record of evidence possession and secure storage from seizure until court presentation. Leaving the evidence overnight in an unlocked cubicle creates a gap in physical control and documentation, allowing opposing counsel to argue that evidence could have been tampered with or altered.

Step-by-Step Solution

1
Analyze the incident responder's actions regarding evidence preservation.
The specialist properly isolated the network cable and labeled/sealed the hardware, but left the item in an unlocked cubicle overnight without logging.
Chain of custody requires documenting every individual who handled the evidence, the exact timestamps of transfers, and continuous verification of secure storage.
2
Identify the procedural flaw in evidence handling.
Leaving evidence in an unmonitored, unlocked area overnight introduces a break in custody and control.
An unmonitored storage period allows for potential unauthorized access or tampering, making it impossible to guarantee evidence integrity in court.
3
Select the option that correctly describes the legal consequence of this procedural gap.
Failing to document secure storage and maintain unbroken physical control invalidates the chain of custody record.
Evidence admissibility relies strictly on proving an unbroken chain of custody from initial seizure to courtroom presentation.

Key Concept

Chain of Custody and Evidence Handling
Estimated Time:2m 0s
Rate this question

Topics

Incident Response and Chain of Custody

More questions from this topic