Courts may later need a laptop seized during a city HR fraud investigation. Which practice best preserves forensic integrity?
Select an answer to reveal the explanation.
Short Explanation
Chain of custody is the signed custody log that proves the city’s evidence laptop was not swapped or altered. Legal hold, careful acquisition, and preservation keep the story courtroom-ready. Casual browsing or emailing images home breaks that story fast.
Full Explanation
Digital forensics supporting potential litigation requires legal hold, documented chain of custody, sound acquisition, preservation of integrity, and clear reporting. Unlogged handling, premature interactive use that alters state, and uncontrolled transfer of images undermine evidentiary value. Municipal investigators must treat seized media as evidence, not ordinary IT troubleshooting.