In short
Chain of custody is the documented record of who collected, handled, transferred and stored evidence, such as a disk image or log files, from the moment it is gathered, so it can be shown not to have been altered.
Key takeaways
- Each transfer records the date, time, people involved and purpose.
- Forensic copies are verified with hash values and analysis is done on the copy, not the original.
- A broken chain can make evidence unusable in legal proceedings or insurance claims.
Where it's tested
ISC: Incident Response & Monitoring — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
During an investigation of suspected fraud, investigators copy a laptop's hard drive and record who handled the copy, when and why. This record is the: