312-49V11 · Question #59
During a forensic investigation into a recent security incident within an organization, the investigator is tasked with documenting every action taken with the evidence to ensure proper chain of…
The correct answer is A. The investigator is preserving the evidence collected from the incident site. According to the CHFI v11 Procedures and Methodology domain, evidence preservation is a critical step in the forensic investigation process and is closely tied to maintaining a proper chain of custody. Preservation ensures that digital evidence remains unaltered, authentic, and…
Question
During a forensic investigation into a recent security incident within an organization, the investigator is tasked with documenting every action taken with the evidence to ensure proper chain of custody. The investigator carefully documents every action taken with the evidence in a logbook. The evidence is tagged with unique identifiers to prevent confusion. A detailed chain of custody record is also created to track the evidence's movement and handling throughout the investigation. Which investigation step is the investigator performing in this scenario?
Options
- AThe investigator is preserving the evidence collected from the incident site.
- BThe investigator is performing scoping on the location where the security incident took place.
- CThe investigator is carrying out data analysis on the evidence for potential findings related to the
- DThe investigator is conducting a search and seizure of the evidence related to the security incident.
How the community answered
(38 responses)- A74% (28)
- B8% (3)
- C3% (1)
- D16% (6)
Explanation
According to the CHFI v11 Procedures and Methodology domain, evidence preservation is a critical step in the forensic investigation process and is closely tied to maintaining a proper chain of custody. Preservation ensures that digital evidence remains unaltered, authentic, and legally admissible from the moment it is collected until it is presented in court or a disciplinary In the given scenario, the investigator is documenting every action, assigning unique identifiers, and maintaining a chain of custody log that records who handled the evidence, when it was handled, and for what purpose. CHFI v11 explicitly defines these actions as part of the evidence preservation phase, which occurs immediately after evidence identification and collection. This phase is designed to prevent evidence tampering, loss, contamination, or misidentification.
Topics
Community Discussion
No community discussion yet for this question.