What is the primary purpose of establishing a chain of custody in digital forensics?

• A. Encrypts evidence for transport
• B. Documentation of who handled evidence, when, where, and how it was stored; preserves integrity and admissibility in court.
• C. Provides a legal defense strategy
• D. Ensures data is backed up on cloud

Answer: (B)

Chain of custody focuses on creating a documented, auditable trail of who handled the evidence, when it was collected or transferred, where it was stored, and how it was protected. This record is essential to keep the digital material trustworthy, showing at every step that it has not been altered and that its integrity can be verified, often using signed logs, seals, timestamps, and hash values. Without such a continuous documentation, the evidence’s integrity can be questioned and its admissibility in court compromised. While encryption during transport addresses confidentiality and backups or legal strategies address other concerns, they do not establish the verifiable custody trail that proves authenticity and integrity over the life of the evidence.