An IT technician is preparing to transfer a physical storage drive containing compromised system evidence to a central forensics laboratory. To maintain an unbroken chain of custody during this evidence transfer, which of the following entries must be documented on the custody tracking log? (Select TWO.)
- The date and timestamp of the evidence handoffAnswer
- The names and signatures of both the releasing and receiving individualsAnswer
- CThe classification of the social engineering threat vector used in the initial breach
- DThe operational specifications of physical access barriers installed at the facility entrance
Answer
The correct documentation entries are the date and timestamp of the evidence handoff, along with the names and signatures of both the releasing and receiving individuals.
Chain of custody protocol requires an unbroken chronological record of everyone who collected, transferred, secured, or analyzed evidence. Recording the exact date and timestamp alongside the printed names and signatures of both the releasing handler and receiving handler establishes legal accountability and continuity of control.
Step-by-Step Solution
Key Concept
Chain of Custody Documentation