In forensics, which principle is essential to maintain evidentiary value?

In forensics, which principle is essential to maintain evidentiary value?

• A. Modify logs to reflect investigations.
• B. Preserve chain of custody, avoid modifying evidence, document steps.
• C. Share evidence with external parties without authorization.
• D. Delete evidence after recovery is complete.

Answer: (B)

Preserving evidentiary value hinges on maintaining the chain of custody: evidence must be kept intact, untouched, and properly documented at every step. This means recording who handles it, where it’s stored, every transfer, and the tools used to examine it, with precise timestamps. Verifying data integrity—using hash checksums, imaging with write blockers, and sealing evidence in tamper-evident containers—helps ensure the recovered material remains exactly as it was found. When these practices are followed, the evidence is trustworthy and more likely to be admissible in court because there’s a clear, auditable record showing it has not been altered or contaminated. Modifying logs, sharing evidence with unauthorized parties, or deleting evidence undermines integrity and legality, which is why they do not fit.

Preserving evidentiary value hinges on maintaining the chain of custody: evidence must be kept intact, untouched, and properly documented at every step. This means recording who handles it, where it’s stored, every transfer, and the tools used to examine it, with precise timestamps. Verifying data integrity—using hash checksums, imaging with write blockers, and sealing evidence in tamper-evident containers—helps ensure the recovered material remains exactly as it was found. When these practices are followed, the evidence is trustworthy and more likely to be admissible in court because there’s a clear, auditable record showing it has not been altered or contaminated. Modifying logs, sharing evidence with unauthorized parties, or deleting evidence undermines integrity and legality, which is why they do not fit.