Computer evidence at a crime scene is documented with a tag stating who had possession of the evidence at a given time. Which of the following does this illustrate?

Question

Options

• ASystem image capture
• BRecord time offset
• COrder of volatility
• DChain of custody

• A
  3% (2)
• B
  5% (3)
• C
  2% (1)
• D
  90% (52)

Explanation

Chain of custody is the documented, chronological record of who collected, handled, transferred, or examined a piece of evidence. It ensures evidence integrity and admissibility in legal proceedings. Each handoff must be documented to prove the evidence was not tampered with. System image capture refers to creating a forensic copy of a storage device. Record time offset is about documenting the difference between a system's clock and actual time for log accuracy. Order of volatility refers to the sequence in which digital evidence should be collected, from most to least volatile.

No community discussion yet for this question.