Which statement about the chain-of-custody for digital evidence is true?

• A. Documentation of collection, secure storage, access logs, and transfer records must be maintained
• B. Access logs are not required
• C. Evidence can be modified without notification
• D. Only the initial collection needs to be documented

Answer: (A)

Maintaining an unbroken, auditable trail of digital evidence is essential to preserve its integrity and admissibility. In practice, that means documenting how the evidence was collected, ensuring the storage is secure so it cannot be altered, keeping access logs that record every person who handles the data and when, and maintaining transfer records every time the evidence changes hands. This combination creates a verifiable record showing the evidence stayed in custody and remained in its original state, or that any change was properly accounted for and justified.

This is why the best answer focuses on documenting collection, secure storage, access logs, and transfer records. Without these records, the evidence can be challenged for authenticity or integrity in court, and investigators rely on hash verifications and proper handling procedures to detect tampering.

Notes on the other ideas: access logs are necessary to show who interacted with the evidence and what was done; any modification or handling must be recorded and justified rather than hidden, and only documenting the initial collection ignores subsequent handling that could affect integrity.