CompTIA Security+ (SY0-701)Security OperationsMedium
During a forensic investigation, an examiner transfers a seized laptop between two analysts. Which documentation must be updated to maintain evidentiary integrity?
- AAsset inventory register
- BVulnerability scan report
- CChain of custody form
- DChange management log
Show answer & explanationAnswer & explanation
Correct answer: C. Chain of custody form
The chain of custody form records every individual who has handled evidence, along with dates, times, and purposes, ensuring the evidence remains admissible and untampered.
Why the other options are wrong
- A. Asset inventory tracks organizational equipment, not evidentiary handling.
- B. A vulnerability scan report is unrelated to evidence handling.
- D. A change management log tracks IT system changes, not evidence transfers.
Chain of Custody
A documented record tracking the handling, transfer, and storage of evidence from collection to presentation in court.
- Establishes evidence authenticity and integrity
- Records who, what, when, where, and why for each transfer
- Break in chain can render evidence inadmissible
Memory trick: Every hand that touches it must sign the chain.