Which of the following best practices is MOST important to document throughout the process to maintain integrity of the findings?

Following an incident, an administrator is gathering forensic evidence from a server for a human resources investigation.

Which of the following best practices is MOST important to document throughout the process to maintain integrity of the findings?
A . Acceptable use policy violations
B . Server configuration
C . Chain of custody
D . Data loss incidents

View Answer

Answer: C

Explanation:

Chain of custody is important because if evidence has been altered or it cannot be proven that it was not altered during the time between collection and use in court, then that evidence is less believable or credible than it otherwise would be.