Which statement about the collected evidence data when performing digital forensics is true?

Digital forensic best practices and legal admissibility requirements mandate that evidence be preserved without alteration and that integrity be verified using hash algorithms such as MD5 or SHA-256. This ensures the evidence has not been tampered with and supports chain-of-custody documentation, which is critical for both investigations and court proceedings.

Immediately distributing evidence to the CISO violates chain-of-custody procedures and introduces unnecessary risk of evidence contamination or unauthorized handling.

While a forensics lab is a suitable environment, evidence handling is not restricted solely to a data custodian - authorized forensic analysts, legal teams, and law enforcement may also handle properly documented evidence.

Deleting forensic evidence violates chain-of-custody requirements, legal hold obligations, and potentially obstructs investigations regardless of PCI compliance considerations.