Examkin

Question

Difficulty: EasyIncident Response and Chain of Custody

An IT technician seizes a compromised workstation computer during a security breach investigation. What is the most critical immediate step the technician must take to maintain the chain of custody for this evidence?

  1. Document the date, time, collection location, and handler details on a chain of custody form.Answer
  2. B
    Open and browse through the suspect files on the drive to verify evidence before logging the device.
  3. C
    Install physical security bollards around the desk area to secure the perimeter.
  4. D
    Classify the security attack type in the ticketing system before securing the physical computer.

Answer

Document the date, time, collection location, and handler details on a chain of custody form.
Chain of custody requires strict documentation tracking every transfer of evidence, including who collected it, when it was taken, where it was stored, and who handled it.

Step-by-Step Solution

1
Identify the primary purpose of chain of custody in forensic procedure.
Chain of custody ensures that evidence is legally defensible by tracking its physical integrity and possession history.
Without clear evidence logging, proof of non-tampering cannot be established.
2
Select the action that preserves evidence tracking.
Recording timestamps, location, and handler signatures immediately establishes the first entry in the evidence log.
Proper documentation must begin the moment evidence is seized.

Key Concept

Chain of Custody Documentation
Estimated Time:45s
Rate this question

Topics

Incident Response and Chain of Custody

More questions from this topic