Examkin

Question

Difficulty: EasyDigital Forensics and Chain of Custody

A security analyst is documenting the collection, movement, and storage of a physical storage drive seized during an incident response investigation. Which of the following best describes the primary purpose of maintaining a formal chain of custody log throughout this process?

  1. To establish a chronological record of evidence handling that proves the item was preserved and remains legally admissible in court.Answer
  2. B
    To capture system RAM and volatile data structures in sequence before powering down the target host.
  3. C
    To ensure data confidentiality across network segments by encrypting the evidence disk image during transfer.
  4. D
    To automatically isolate infected host systems from the corporate network upon alert generation.

Answer

The primary purpose of maintaining a chain of custody log is to establish a detailed chronological record of evidence handling, ensuring that the evidence is preserved without tampering and remains legally admissible.
Maintaining a chain of custody log creates a continuous, auditable record showing who collected, transferred, analyzed, and safeguarded evidence. This documentation guarantees that evidence has not been altered or compromised, proving its authenticity and admissibility in legal proceedings.

Step-by-Step Solution

1
Identify the core forensic requirement described in the scenario.
The scenario highlights documenting the collection, movement, and storage of physical evidence.
Maintaining evidence integrity requires tracking every individual who handles the evidence from acquisition to court presentation.
2
Differentiate between physical evidence logging and technical evidence acquisition procedures.
Technical procedures capture data (e.g., order of volatility), while chain of custody provides the legal proof of custody and integrity.
Without a documented chain of custody, evidence can be challenged in court as tampered or unauthenticated.

Key Concept

Chain of Custody
Estimated Time:45s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic