During a security event investigation, a junior analyst fails to create an image of a server's hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from…

Continuity of operations is a business resilience concept focused on maintaining critical functions during disruptions and has no bearing on forensic evidence collection procedures.

Chain of custody documents who handled evidence and when, but the core procedural failure was not imaging the drive before removal - an error in evidence collection sequence rather than documentation.

Order of volatility is the forensic principle that evidence must be collected in sequence based on how quickly or easily it can be altered - disk images must be captured while the drive is in its original installed state before any physical handling occurs. By removing the drive without first creating a forensic image, the analyst broke the collection sequence required by order of volatility, making it impossible to prove the drive's contents were not altered during removal and transit, which rendered the evidence inadmissible.

Data recovery is the process of retrieving lost or corrupted data and is not a procedural framework governing how investigators must collect and preserve forensic evidence.