Organizations or incident response teams need to protect the evidence for any future legal actions that may be taken against perpetrators that intentionally attacked the computer system. EVIDENCE…

Question

Options

• AChain-of-Precedence
• BChain-of-Custody
• CNetwork and host log records
• DForensic analysis report

• A
  2% (1)
• B
  87% (41)
• C
  6% (3)
• D
  4% (2)

Explanation

Chain-of-Custody (B) is a formal document that records every person who handled, accessed, or transferred a piece of evidence - creating an unbroken, auditable trail that protects evidence integrity from the moment of collection through court proceedings, satisfying both legal admissibility and compliance requirements.

Why the distractors are wrong:

• A. Chain-of-Precedence - not a real forensics term; a fabricated distractor designed to sound similar to Chain-of-Custody.
• C. Network and host log records - these are evidence themselves, not a document that protects evidence from damage or tampering.
• D. Forensic analysis report - documents findings and conclusions from an investigation but does not govern evidence handling or protect its integrity.

Memory tip: Think of Chain-of-Custody as a receipt chain - every time evidence changes hands, someone "signs the receipt." If any link breaks, the evidence may be inadmissible in court, just like a broken chain falls apart.

No community discussion yet for this question.