Examkin

Question

Difficulty: EasyDigital Forensics and Chain of Custody

A digital forensics investigator takes possession of a storage drive seized during an internal security investigation. What is the primary purpose of completing a chain of custody document for this evidence?

  1. To maintain a continuous, chronological record of every person who collected, handled, transferred, and stored the evidenceAnswer
  2. B
    To establish non-repudiation by encrypting the physical drive using asymmetric key pairs
  3. C
    To preserve volatile system memory (RAM) before shutting down the source computer
  4. D
    To continuously recalculate cryptographic hashes on the active operating system partition

Answer

To maintain a continuous, chronological record of every person who collected, handled, transferred, and stored the evidence
The primary objective of maintaining a chain of custody document is to create an unbroken, verifiable log showing who collected, received, secured, and transferred evidence. This documentation proves that evidence was safeguarded against contamination or unauthorized access, satisfying legal requirements for court admissibility.

Step-by-Step Solution

1
Identify the primary purpose of chain of custody in digital forensics
Chain of custody ensures legal defensibility by tracking evidence custody and preventing allegations of tampering.
Courtroom evidence admissibility requires proof of who collected, accessed, and secured the evidence at all times.
2
Evaluate the option choices against forensics definitions
The option stating that chain of custody maintains a continuous, chronological record of handling matches standard forensic evidence procedures.
Other options confuse chain of custody with cryptographic controls (digital signatures, hashing) or live data collection procedures (order of volatility).

Key Concept

Chain of Custody Documentation
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic