Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

A digital forensics specialist receives a sealed evidence bag containing a seized hard drive from a field investigator for intake into the forensic laboratory. Which of the following actions should the specialist perform first to maintain the chain of custody?

  1. Inspect the tamper-evident container, verify the serial numbers against the transfer documentation, and sign the custody log.Answer
  2. B
    Connect the drive directly to an analysis workstation to verify the file system structure before logging receipt.
  3. C
    Generate a cryptographic hash of the drive contents to establish non-repudiation of the field investigator's identity.
  4. D
    Create a bit-stream disk image directly onto the original evidence drive to preserve the master boot record.

Answer

The specialist should inspect the tamper-evident container, verify serial numbers against transfer documentation, and sign the custody log.
Maintaining proper chain of custody requires documenting every physical transfer of evidence immediately upon receipt. Verifying tamper-evident seals and matching serial numbers against custody forms before signing ensures uninterrupted accountability and legal admissibility.

Step-by-Step Solution

1
Examine physical evidence packaging upon receipt
Assures the evidence bag and tamper seals have remained intact since seizure.
Physical integrity of packaging proves evidence was not altered in transit.
2
Reconcile item identification numbers with the chain of custody form
Confirms the exact physical evidence handed over matches official records.
Mismatched serial numbers undermine legal admissibility in court.
3
Record timestamp, relinquishing party, receiving party, and signature on the custody log
Establishes unbroken accountability for physical possession.
Chain of custody requires an uninterrupted chronological record of custody.

Key Concept

Chain of Custody Intake and Evidence Handling
Estimated Time:1m 0s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic