200-201 Question 200
Select 3During an investigation of a suspected insider threat, a cybersecurity analyst collects a USB drive from the suspect’s workstation. To ensure the evidence remains admissible in court, which of the following actions should the analyst take to maintain the chain of custody?
- A
Document every individual who handles the USB drive, including timestamps.
- B
Directly analyze the data on the USB drive without creating a forensic copy.
- C
Store the USB drive in a secure, tamper-evident evidence bag.
- D
Sign over custody of the USB drive verbally without written documentation.
- E
Ensure the USB drive is accessed only by authorized personnel.
Show answer and explanation
Correct answers: A, C, E
Explanation
Maintaining the chain of custody is crucial for ensuring evidence is admissible in legal proceedings. This involves documenting all handling of the evidence (including timestamps), storing it securely in tamper-evident containers, and limiting access to authorized personnel. Actions such as bypassing forensic practices or failing to document handovers compromise the integrity of the evidence and can render it inadmissible.
- A. Correct.
Correct: Documenting everyone who handles the evidence and including timestamps ensures accountability and traceability, which is critical for maintaining the chain of custody.
- B. Incorrect.
Incorrect: Directly analyzing the data without creating a forensic copy could compromise the integrity of the evidence and violate proper chain of custody procedures.
- C. Correct.
Correct: Storing evidence in a secure, tamper-evident bag helps protect its integrity and demonstrates that it has not been altered or accessed without authorization.
- D. Incorrect.
Incorrect: Verbal handovers without written documentation provide no formal record of the evidence transfer, which breaks the chain of custody.
- E. Correct.
Correct: Restricting access to authorized personnel helps prevent tampering or unauthorized access, ensuring the evidence remains credible and admissible.