Forensic readiness and chain of custody.

• A. Documenting who collected, when, and how evidence was handled throughout the investigation.
• B. Ensuring data is encrypted at rest.
• C. Deleting metadata to avoid leaks.
• D. Replacing old evidence with modern equivalents.

Answer: (A)

The main idea here is establishing a solid chain of custody to prove the integrity and provenance of evidence. Documenting who collected the evidence, when it was collected, and exactly how it was handled keeps a transparent, auditable trail from seizure to presentation. This makes it possible to verify authenticity, detect any alterations, and defend admissibility in court. Forensic readiness hinges on having procedures and records in place so investigations can start quickly and evidence remains traceable and defensible.

Other options miss the purpose: encrypting data at rest protects confidentiality but doesn’t record who did what with the evidence or when, so it doesn’t address provenance. Deleting metadata would remove important contextual information that helps establish timelines and authenticity. Replacing old evidence with newer equivalents is tampering and destroys the integrity of the evidentiary trail.