A university case file holds four notes: a stolen laptop, a group claim of responsibility, a file hash, and a sign-out sheet for the imaged drive. Which note is the chain of custody?
Select an answer to reveal the explanation.
Short Explanation
You can spot the chain of custody in the sign-out sheet, which records who received the drive and when they released it. The stolen laptop, group claim, and file hash describe the asset, an actor statement, and an indicator of compromise—not the drive’s handling.
Full Explanation
Chain of custody is the record of who handled evidence and when it changed hands. Here, the sign-out sheet listing who received the drive and the time they released it back is the custody record: it documents the handlers and the receive and release times for the imaged drive. The stolen laptop is the asset named in the case header and missing from the university lab; identifying the missing machine does not document who handled the drive. The group claim is an actor statement taking credit for the theft; it is not a handling log and does not establish who received or released the drive. The file hash is an indicator of compromise recovered from the drive image; it identifies a file, not the sequence of people who held the drive. Exam caveat: a group claim and a custody record may appear in the same case file, but they serve different purposes; a claim by itself does not identify a person. Practical check: confirm that the sign-out sheet names each handler and records when that person received and released the drive.