A disk image taken from a cloud VM will pass between three analysts and an external lab over several weeks and may be presented in court. Which practice best demonstrates that the evidence was not altered and is properly accounted for?
Select an answer to reveal the explanation.
Short Explanation
A hash is the evidence's fingerprint, and the chain of custody is its travel diary. You take the fingerprint at pickup, check it at every handoff, and log who had it and when. The trap is a control that keeps it secret but can't prove it's unchanged or who touched it.
Full Explanation
Evidence management has two complementary requirements. Integrity is demonstrated with cryptographic hashes: a hash of the image is computed at acquisition, recorded, and recalculated whenever the evidence is transferred or analysed; a matching value shows the content has not changed. Accountability is demonstrated with a chain of custody: a continuous record of who collected the evidence, who held it at each point, when and why it was transferred, and how it was stored. Encrypting the image with a shared key protects confidentiality, but it does not show whether someone with the key altered the content. Versioned object storage retains prior versions, yet granting write access to several analysts invites modification of the original, and versioning alone is not a documented custody record. Keeping a single compressed copy on one workstation creates a single point of failure, places evidence on a general-purpose device, and does nothing to prove integrity or record handoffs; analysis should be performed on working copies, never the original. Exam caveat: ISO/IEC 27037 covers preservation of potential digital evidence and is the standard to associate with these handling practices. Operational check: compare the acquisition hash with the current hash of the stored image, and confirm that the custody log shows an unbroken sequence of signed handoffs with dates, times and purposes.