Examkin

Question

Difficulty: EasyIncident Response and Chain of Custody

An IT technician is tasked with documenting the transfer of a seized workstation hard drive to a forensic analyst during an incident investigation. Which of the following details MUST be recorded on the chain of custody log during this transfer? (Select TWO.)

  1. The date and timestamp of the evidence transferAnswer
  2. The full name and signature of both the transferring technician and the receiving analystAnswer
  3. C
    The complete directory structure and user file listing stored on the hard drive
  4. D
    The physical keycard access logs for the room where the workstation was located

Answer

The chain of custody log must include the date and timestamp of the transfer, as well as the full names and signatures of both the person releasing and the person receiving the evidence.
Maintaining an unbroken chain of custody requires logging the exact date and timestamp of the transfer alongside the names and signatures of both the releasing technician and the receiving analyst. This establishes legal accountability and proves continuous control of the evidence.

Step-by-Step Solution

1
Identify the purpose of a chain of custody log
Recognize that the form serves to track evidence ownership, custody transfers, and integrity over time.
Chain of custody forms require strict legal and procedural accountability.
2
Evaluate required documentation fields for evidence transfer
Identify that the transfer timestamp and signatures of both handlers (releasing and receiving) are essential.
Without timestamps and signatures, proof of continuous custody is broken.

Key Concept

Chain of Custody Documentation Requirements
Estimated Time:1m 0s
Rate this question

Topics

Incident Response and Chain of Custody

More questions from this topic