An analyst prepares to transfer a forensic image of a compromised workstation to legal review. The image has been acquired and verified. Which action best preserves admissibility during transfer?
Select an answer to reveal the explanation.
Short Explanation
Think of chain of custody like a passport for evidence: every handoff needs a stamp. If you skip a handler or timestamp, a defense attorney can ask who touched it and when, and the image looks suspect. You don’t just prove the file hasn’t changed—you prove the people handling it haven’t.
Full Explanation
Chain of custody is the documented trail showing who possessed, transferred, and verified evidence from acquisition through review. A signed chain-of-custody form should travel with the evidence package and be updated at each handoff, including transfer method and verification hash. In legal or disciplinary proceedings, admissibility depends not only on the forensic image’s integrity but on a continuous, signed record proving no unauthorized person accessed or altered it. Hashing detects changes, but it does not identify custodians or timestamps. Secure transmission protects confidentiality, but it does not establish possession history. Physical storage protects the media, but without transfer logs it cannot prove the image reached legal review unaltered. Omitting intermediate handlers creates a gap in the record and invites challenges about unaccounted custody. Exam caveat: When the question mentions legal review or admissibility, choose the answer that emphasizes documented custody, not just technical integrity. Operational check: Before transfer, verify the acquisition hash, then require each person who touches the media to sign the custody log with date, time, action, and verification hash.