Log files from a cloud application will be presented as evidence in a lawsuit about unauthorized changes to customer accounts. Opposing counsel is expected to challenge whether the logs were altered after collection. What must the organization be able to demonstrate?
Select an answer to reveal the explanation.
Short Explanation
Picture an evidence bag at a crime scene: sealed, signed and logged every time it changes hands. Your log files need the same treatment, a custody record plus hashes that prove nobody touched them. Converting or relocating them doesn't help, and a powerful admin collecting them is a weakness, not a strength.
Full Explanation
Admissibility of digital evidence rests on showing that the item presented is the item collected and that it has not changed. A chain of custody records every person who handled the evidence, when, where and why, from acquisition through storage and transfer to presentation. Cryptographic hashes calculated at collection and re-verified at each handoff provide technical proof of integrity, so any alteration would be detectable. Together they answer the challenge that the logs were modified. Having the most senior administrator collect the logs strengthens nothing; broad privileges actually invite the argument that the collector could have altered them, and seniority is not a substitute for documentation. Storing data in a particular region addresses jurisdiction and sovereignty questions, not integrity. Converting logs into a spreadsheet changes their format and creates a derivative work, which weakens the argument that the evidence is original unless the originals and their hashes are preserved separately. Exam caveat: ISO/IEC 27037 covers identification, collection, acquisition and preservation of digital evidence, and in cloud cases the provider may need to participate in collection under contract. Operational check: confirm the custody form lists every transfer, and recompute the hashes to match the values recorded at acquisition.