What is chain of custody in digital evidence?

• A. A documented trail showing how evidence was collected, stored, transferred, and preserved.
• B. A method for encrypting evidence to prevent access.
• C. A rule about release of evidence to the public.
• D. A policy for labeling only physical evidence.

Answer: (A)

Chain of custody is the documented trail that records every step in the life of evidence—from the moment it is collected, through storage and transfer, to its final disposition. In digital forensics this means logging who accessed the data, what actions were taken (imaging, copying, analysis), when those actions occurred, and how the data was stored or protected (such as using hash verifications, write-protection, and secure storage). This record preserves the integrity and authenticity of the evidence, which is crucial for its admissibility in court. If the chain isn’t well documented, the evidence can be challenged because there’s no verifiable record showing it hasn’t been tampered with. The other ideas—encrypting data, rules about public release, or labeling only physical evidence—do not capture the ongoing, verifiable trail that shows how digital evidence was collected, handled, and preserved.