Describe chain of custody and its importance in digital forensics.

• A. Documentation of evidence handling from collection to presentation, ensuring integrity and admissibility.
• B. A chain of custody is a list of hardware inventory.
• C. A method for securing network devices.
• D. A policy for password management.

Answer: (A)

Chain of custody is the documented, verifiable trail that shows who handled a piece of evidence, when, where, and under what conditions, from the moment it is collected to its presentation in a proceeding or investigation. This record is essential because it proves the evidence has remained intact and unaltered, supporting its integrity and admissibility in court. In digital forensics, that means every action is tied to a case and timestamp, using measures such as secure storage for devices, tamper‑evident seals, cryptographic hashes to prove data integrity, write-blockers during acquisition, and immutable logs that record access, transfers, copies, and analyses. It also includes how the evidence was stored, who accessed it, and what analyses were performed, so findings can be independently verified. Without a solid chain of custody, even a sound forensic analysis can be challenged or deemed inadmissible due to questions about potential tampering or mishandling. The other options describe asset inventories, device security methods, or password policies, which do not track the provenance and handling of evidence.