During evidence handling, which practice supports integrity and chain of custody?

During evidence handling, which practice supports integrity and chain of custody?

• A. Disable all remote access to the system
• B. Permit only authorized personnel to access
• C. Ignore temperature protection
• D. Work on the original storage medium

Answer: (B)

Access control is fundamental to preserving evidence integrity and chain of custody. When only authorized personnel can access the evidence, there is an auditable record of who handled it, when, and what actions were taken. This creates accountability and prevents unauthorized modifications, which is essential for maintaining an unbroken chain of custody. The option that fits best is permitting only authorized personnel to access, because it directly enforces who may interact with the evidence and ensures traceability of all handling. Disabling remote access might improve security in some contexts but does not by itself establish who touched the evidence or guarantee an intact chain. Ignoring temperature protection risks degrading the evidence and compromising its integrity. Working on the original storage medium can alter the evidence, whereas proper practice is to create a forensic image and work on a copy to preserve the original.

Access control is fundamental to preserving evidence integrity and chain of custody. When only authorized personnel can access the evidence, there is an auditable record of who handled it, when, and what actions were taken. This creates accountability and prevents unauthorized modifications, which is essential for maintaining an unbroken chain of custody.

The option that fits best is permitting only authorized personnel to access, because it directly enforces who may interact with the evidence and ensures traceability of all handling. Disabling remote access might improve security in some contexts but does not by itself establish who touched the evidence or guarantee an intact chain. Ignoring temperature protection risks degrading the evidence and compromising its integrity. Working on the original storage medium can alter the evidence, whereas proper practice is to create a forensic image and work on a copy to preserve the original.