Which practice most directly supports evidence integrity in digital forensics?

Which practice most directly supports evidence integrity in digital forensics?

• A. Maintaining a documented chain of custody and using verified hash values to confirm integrity.
• B. Relying on the investigator's memory of the process.
• C. Deleting original media after collection to protect privacy.
• D. Only recording evidence in a spreadsheet.

Answer: (B)

Preserving evidence integrity hinges on an auditable, verifiable trail of handling and on ensuring the data hasn’t been altered. A documented chain of custody records every transfer, copy, and access, including who performed it and when, creating accountability and a way to prove the evidence remained intact throughout the investigation. Pair that with verified hash values—cryptographic digests computed at collection and re-checked at every stage—so any change to the data would produce a different hash, signaling tampering or corruption. Relying on memory is unreliable, deleting original media can destroy crucial evidence, and recording only in a spreadsheet fails to provide tamper-evidence or a complete, verifiable trail. Together, chain of custody and hashing offer the strongest safeguard for evidence integrity in digital forensics.

Preserving evidence integrity hinges on an auditable, verifiable trail of handling and on ensuring the data hasn’t been altered. A documented chain of custody records every transfer, copy, and access, including who performed it and when, creating accountability and a way to prove the evidence remained intact throughout the investigation. Pair that with verified hash values—cryptographic digests computed at collection and re-checked at every stage—so any change to the data would produce a different hash, signaling tampering or corruption. Relying on memory is unreliable, deleting original media can destroy crucial evidence, and recording only in a spreadsheet fails to provide tamper-evidence or a complete, verifiable trail. Together, chain of custody and hashing offer the strongest safeguard for evidence integrity in digital forensics.