A cybersecurity analyst is preparing to transfer a compromised server hard drive to an external forensic laboratory for legal analysis. The internal incident log currently includes the drive's model and serial number, the date and time of initial seizure, the acquiring technician's signature, and the secure storage room location. Which of the following details MUST be recorded on the chain-of-custody form at the moment of handoff to maintain evidence admissibility?
- The recipient's name, signature, and the exact date and time of the physical transferAnswer
- BA detailed file path listing of all suspicious files opened and examined on the live server
- CThe physical security keycard log entries for the server room where the incident occurred
- DThe specific social engineering vector classification used during the initial intrusion
Answer
The recipient's name, signature, and the exact date and time of the physical transfer
A chain of custody log must document a complete, unbroken record of every individual who takes possession of evidence. When transferring hardware to a third party, recording the recipient's full name, signature, and the exact timestamp of transfer is mandatory to prove the evidence was safeguarded and untampered with.
Step-by-Step Solution
Key Concept
Chain of Custody Documentation Requirements