Examkin

Soru

Zorluk: KolayIncident Response and Chain of Custody

An IT technician is tasked with documenting the transfer of a seized workstation hard drive to a forensic analyst during an incident investigation. Which of the following details MUST be recorded on the chain of custody log during this transfer? (Select TWO.)

  1. The date and timestamp of the evidence transferCevap
  2. The full name and signature of both the transferring technician and the receiving analystCevap
  3. C
    The complete directory structure and user file listing stored on the hard drive
  4. D
    The physical keycard access logs for the room where the workstation was located

Cevap

The chain of custody log must include the date and timestamp of the transfer, as well as the full names and signatures of both the person releasing and the person receiving the evidence.
Maintaining an unbroken chain of custody requires logging the exact date and timestamp of the transfer alongside the names and signatures of both the releasing technician and the receiving analyst. This establishes legal accountability and proves continuous control of the evidence.

Adım Adım Çözüm

1
Identify the purpose of a chain of custody log
Recognize that the form serves to track evidence ownership, custody transfers, and integrity over time.
Chain of custody forms require strict legal and procedural accountability.
2
Evaluate required documentation fields for evidence transfer
Identify that the transfer timestamp and signatures of both handlers (releasing and receiving) are essential.
Without timestamps and signatures, proof of continuous custody is broken.

Anahtar Kavram

Chain of Custody Documentation Requirements
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru