When storing computer evidence, which of the following should be recorded?

When storing computer evidence, which of the following should be recorded?

• A. Date and time of seizure
• B. Make, model, serial number
• C. User name recorded
• D. IP address

Answer: (B)

Accurate hardware identifiers create a precise reference to the exact device you’re handling, which is essential for preserving the integrity of evidence. The make and model tell you the device family and capabilities, while the serial number uniquely identifies that individual unit. Having these identifiers ensures you can reliably track and verify the same machine through all stages of collection, imaging, analysis, and storage, preventing mix-ups with similar devices and supporting a solid chain of custody and authenticity. Other metadata like when the seizure occurred, the user who logged in, or the device’s IP address can be important in context, but they do not uniquely identify the physical unit in a way that remains stable over time. IPs can change, and user names can be reassigned or misused, so they’re supplementary rather than a definitive identifier.

Accurate hardware identifiers create a precise reference to the exact device you’re handling, which is essential for preserving the integrity of evidence. The make and model tell you the device family and capabilities, while the serial number uniquely identifies that individual unit. Having these identifiers ensures you can reliably track and verify the same machine through all stages of collection, imaging, analysis, and storage, preventing mix-ups with similar devices and supporting a solid chain of custody and authenticity.

Other metadata like when the seizure occurred, the user who logged in, or the device’s IP address can be important in context, but they do not uniquely identify the physical unit in a way that remains stable over time. IPs can change, and user names can be reassigned or misused, so they’re supplementary rather than a definitive identifier.