220-801 · Question #573
Which of the following protocols would be MOST important in preserving digital evidence of criminal activity during an investigation?
The correct answer is B. Chain of custody. Chain of custody is the formal process of documenting and tracking evidence from collection to courtroom to ensure its integrity and admissibility.
Question
Which of the following protocols would be MOST important in preserving digital evidence of criminal activity during an investigation?
Options
- AChange control management
- BChain of custody
- CChannel escalation
- DMSDS documents
How the community answered
(38 responses)- A3% (1)
- B89% (34)
- C3% (1)
- D5% (2)
Why each option
Chain of custody is the formal process of documenting and tracking evidence from collection to courtroom to ensure its integrity and admissibility.
Change control management governs modifications to IT systems and configurations, not the handling of evidence.
Chain of custody is the documented, unbroken trail of accountability for digital evidence, recording who collected it, who handled it, and how it was stored. Without this process, evidence can be challenged as tampered with or contaminated. It is a foundational requirement in forensic investigations to ensure evidence holds up in legal proceedings.
Channel escalation refers to routing a support issue to a higher tier, which has no relevance to evidence preservation.
MSDS (Material Safety Data Sheets) documents describe hazardous chemical properties and are unrelated to digital forensics.
Concept tested: Digital forensics chain of custody procedures
Source: https://www.nist.gov/system/files/documents/2017/04/28/SP800-86.pdf
Topics
Community Discussion
No community discussion yet for this question.