What best describes chain of custody in digital evidence?

• A. A documented trail showing how evidence was collected, stored, transferred, and preserved.
• B. A method for encrypting data to protect privacy.
• C. A legal threshold for evidentiary admissibility.
• D. A policy for social media sharing.

Answer: (A)

Chain of custody is the documented trail that shows who handled digital evidence, when, where, and for what purpose, as well as how it was stored and protected from alteration from collection through analysis to presentation. In practice, this means keeping formal custody records for every transfer or copy, preserving the original data and any images with proper integrity checks (like hashes) to verify nothing was changed, and using secure storage and access controls. This ongoing, verifiable log demonstrates the evidence’s integrity and authenticity, which is essential for it to be trusted in court. Encrypting data protects privacy, but that’s not about tracing handling of the evidence. The idea of a legal threshold for admissibility refers to general requirements for evidence to be admitted, which chain of custody supports but isn’t the same thing. And a policy for social media sharing is unrelated to how digital evidence is tracked and preserved.