What is the primary purpose of maintaining a chain of custody during a digital forensic investigation?
Select an answer to reveal the explanation.
Short Explanation
You need a chain of custody to track who handled the evidence, when, and why. That documentation proves the evidence wasn’t tampered with and keeps it admissible in legal proceedings.
Full Explanation
The correct purpose is to document who had access to evidence and ensure its integrity for legal proceedings. Chain of custody records every person who handled evidence, when, and why, supporting admissibility by showing it was not tampered with. The option about completing the investigation quickly and efficiently is wrong because speed is not the purpose of chain-of-custody documentation. The option about backup copies of forensic artifacts is wrong because backups are separate evidence-handling practice, not the core legal purpose. The option about satisfying incident response service-level agreement requirements is wrong because service-level agreement compliance is a business process concern, not the evidentiary purpose of chain of custody.