Courts may later need a laptop seized during a city HR fraud investigation. Which practice best preserves forensic integrity?

When a seized laptop may become evidence in a city HR fraud matter, forensic integrity depends on legal hold, documented chain of custody, sound acquisition, preservation, analysis, and reporting. Chain of custody records who collected the device, when and where, how it was sealed and stored, who accessed it, and what imaging or examination steps occurred. Acquisition should follow forensically sound methods—typically write-blocked imaging with hash verification—so the working copy can be examined without altering the original. Legal hold ensures relevant custodians and data are preserved against routine deletion. Together these practices allow the municipality to demonstrate that evidence presented later is authentic and untampered.

Allowing multiple technicians to image without a transfer log breaks accountability and invites authenticity challenges. Powering the laptop repeatedly to browse files before imaging alters volatile state and can modify disk metadata, contaminating the evidence. Emailing raw disk images to personal accounts creates uncontrolled copies outside municipal custody, violates handling policy, and risks exposure of sensitive HR data. Exam tip: stems about courts or legal proceedings point to chain of custody and proper forensic process, not convenience shortcuts. Operationally, use sealed evidence bags and logs from seizure through storage, image with validated tools and hash comparison, restrict analysis to authorized examiners on controlled systems, and coordinate with legal counsel before any release of findings or media.