After a suspected insider leak of permit-office records, investigators seize a clerk's laptop and relevant log exports. What practice is essential for those materials?
Select an answer to reveal the explanation.
Short Explanation
Evidence is like a sealed ballot box — if anyone can rummage through it undocumented, nobody trusts what you found later. Track who collected, sealed, moved, and stored the laptop and logs. Wipe-and-return, public posts, or casual browsing break the chain.
Full Explanation
Investigations require disciplined evidence handling: identify, collect, protect, and track materials with a documented chain of custody covering custody transfers and storage conditions. Premature reimaging, uncontrolled sharing, or undocumented access can destroy forensic value and weaken later HR, legal, or criminal use. Security operations teams must treat digital and physical evidence as controlled assets throughout the case.