Examkin

Question

Difficulty: EasyDigital Forensics and Chain of Custody

A security technician has isolated a physical hard drive containing forensic evidence from a workstation involved in an internal investigation. The technician must transport the drive to a secure off-site facility for forensic imaging. Which of the following actions is most critical to preserve the legal admissibility of the physical evidence during transport?

  1. Maintaining a chain of custody document that records every physical transfer, including dates, times, and signatures of handlers.Answer
  2. B
    Encrypting the evidence drive with asymmetric keys immediately before transport to ensure data non-repudiation.
  3. C
    Executing bulk data re-encryption using an asymmetric public key to increase transport security performance.
  4. D
    Reassigning the technical data custodian authority to the transport courier during transit.

Answer

Maintaining a chain of custody document that records every physical transfer, including dates, times, and signatures of handlers.
Maintaining a comprehensive chain of custody form ensures that every transfer of physical control is logged with exact dates, times, purpose, and signatures of all handlers. This documentation establishes evidence provenance and proves that the evidence was continuously safeguarded against unauthorized access or modification.

Step-by-Step Solution

1
Identify the primary requirement for legal evidence admissibility during physical transport.
Recognize that proof of continuous control and documentation of handler custody is mandatory.
Forensic evidence must be accounted for at all times to prevent allegations of evidence tampering or loss of integrity.
2
Evaluate operational procedures against digital forensics standards.
Logging each transfer with exact timestamps, handler identities, and signatures establishes a unbroken chain of custody.
Chain of custody forms provide verifiable proof of evidence provenance in judicial proceedings.

Key Concept

Chain of Custody and Evidence Provenance
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic