220-1102 Question 734
Single answerChain of custodyA technician is asked to collect a company laptop after HR reports possible data theft by an employee. The security manager says the device may be needed as evidence in a legal case. After receiving the laptop from the employee's desk, which action should the technician take NEXT to best preserve chain of custody?
- A
Power on the laptop and review recent files so the technician can describe what was found
- B
Document the date, time, device details, and who transferred possession, then secure the laptop in an evidence bag or locked container
- C
Give the laptop to the employee's manager because they are responsible for the department's equipment
- D
Copy the user's files to a USB drive before storing the laptop so investigators have a backup
Show answer and explanation
Correct answer: B
Explanation
Chain of custody is the documented history of evidence possession, handling, and location from the moment it is collected until final disposition. In an A+ Core 2 context, the technician's role is to preserve the device, document collection details, and maintain a clear record of transfers rather than examine or alter the contents. Best practices include recording the date and time of collection, the person surrendering the device, the person receiving it, unique device identifiers such as serial number or asset tag, and the method of storage. The device should then be secured in tamper-evident packaging or a locked evidence container. These steps align with standard digital evidence handling principles used in organizational incident response and legal proceedings, where maintaining integrity and accountability is critical.
- A. Incorrect.
This is incorrect because powering on the laptop and reviewing files changes the state of potential evidence and may alter timestamps, logs, or open-file data. In a chain-of-custody situation, the technician should avoid unnecessary access and instead preserve the evidence in its current condition for authorized investigators or forensic personnel.
- B. Correct.
This is correct because chain of custody requires a documented, traceable record of who had possession of the item, when it was collected, and how it was secured. Recording identifying details and transfer information, then placing the device in an evidence bag or secured storage, helps show the evidence was controlled and not tampered with after collection.
- C. Incorrect.
This is incorrect because handing the laptop to the employee's manager breaks controlled evidence handling unless that person is part of the documented custody process. A common misconception is that normal asset ownership rules apply, but once a device may be legal evidence, possession must be limited, documented, and secured.
- D. Incorrect.
This is incorrect because copying files before proper authorization and documentation can modify evidence, create questions about integrity, and exceed the technician's role. Although creating forensic copies can be valid in an investigation, it should be performed using approved procedures by authorized personnel after chain of custody has been established.