During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

During the collection phase, investigators identify data sources, acquire the data, and label and record each item to maintain a documented chain of custody. This labeling and recording is critical to preserving evidentiary integrity so the data is admissible and trustworthy throughout the investigation.

The examination phase involves processing and filtering previously collected data to identify and extract relevant pieces of information, not labeling and recording.

The reporting phase involves documenting the overall methodology, findings, and conclusions after the analysis is complete.

Investigation is not a distinct named phase in the standard NIST digital forensics process model; the defined phases are collection, examination, analysis, and reporting.