During an internal investigation, a hard drive containing evidence was passed among four staff members over two weeks, with no record of who held it, when, or why. Defense counsel now challenges the evidence. Which problem does this situation MOST directly illustrate?

Chain of custody is the documented, unbroken record of who collected evidence, who held it at each point, when and why it was transferred, and how it was stored. It demonstrates that the evidence presented is the same item that was collected and that it was not altered. When an evidence drive passes among several people with no record, the organization cannot show that tampering or accidental modification did not occur, which is the basis of the challenge. Typical controls include evidence forms, signatures at each transfer, tamper-evident packaging, secure storage, and hashes recorded at acquisition. A legal hold instructs custodians to preserve potentially relevant data and suspends routine deletion; the problem here is undocumented handling, not premature deletion. The order of volatility guides which data to capture first, such as memory before disk; the scenario describes no collection sequence error. E-discovery is the process of identifying, preserving, and producing electronically stored information for legal matters; indexing for search is not the issue raised. Exam caveat: hashing the acquired image supports integrity, but it does not replace documentation of who handled the original media. Operational check: confirm every evidence item has a custody log with signatures and timestamps for each transfer.