During an internal fraud investigation, a security analyst seizes a desktop computer and generates a forensic image of the primary storage drive. Months later, during a legal proceeding, opposing counsel moves to suppress the forensic disk image evidence. Which of the following circumstances would serve as the strongest basis for suppressing the evidence due to a breakdown in the chain of custody?
- An unrecorded gap exists in the evidence log showing a missing signature during the physical transfer of the drive between two investigators.Answer
- BThe forensic investigator acquired the disk image using a software write-blocker rather than a hardware write-blocker.
- CThe forensic investigator calculated an SHA-256 cryptographic hash instead of applying an asymmetric digital signature to the image.
- DThe target hard drive was imaged over a dedicated gigabit network interface rather than a direct local connection.
Answer
An unrecorded gap in the physical evidence log showing a missing signature during transfer serves as the strongest basis for suppressing evidence due to a chain of custody failure.
The chain of custody is a strict administrative and legal process requiring detailed record-keeping of every individual who collected, transported, accessed, or secured physical evidence. An unrecorded transfer or missing custodian signature creates an unverified gap in possession, making it impossible to legally guarantee that the evidence was not tampered with, swapped, or altered.
Step-by-Step Solution
Key Concept
Chain of Custody and Evidence Admissibility