The data acquisition process should include preserving evidence by protecting it from temperature extremes and by using controlled handling.

The data acquisition process should include preserving evidence by protecting it from temperature extremes and by using controlled handling.

• A. Maintaining a controlled environment to protect evidence from temperature extremes
• B. Taking copies of the evidence but never verifying checksums
• C. Allowing anyone to access evidence without logging
• D. Modifying data to fit a narrative

Answer: (A)

Preserving evidence during data acquisition hinges on protecting the physical media from environmental changes and enforcing strict handling to maintain the chain of custody. Temperature extremes can cause hardware to behave unpredictably, lead to data corruption, or even cause media failure, so keeping the environment controlled helps ensure the acquired data truly reflects the original state. Controlled handling ensures only authorized personnel access the evidence, proper documentation and labeling occur, and the data remains unaltered and traceable throughout the process. The other options undermine integrity: taking copies without verifying checksums means you can’t be sure the copy matches the original exactly; unrestricted access without logging breaks the chain of custody; and modifying data to fit a narrative is manipulation and invalidates the evidence.

Preserving evidence during data acquisition hinges on protecting the physical media from environmental changes and enforcing strict handling to maintain the chain of custody. Temperature extremes can cause hardware to behave unpredictably, lead to data corruption, or even cause media failure, so keeping the environment controlled helps ensure the acquired data truly reflects the original state. Controlled handling ensures only authorized personnel access the evidence, proper documentation and labeling occur, and the data remains unaltered and traceable throughout the process.

The other options undermine integrity: taking copies without verifying checksums means you can’t be sure the copy matches the original exactly; unrestricted access without logging breaks the chain of custody; and modifying data to fit a narrative is manipulation and invalidates the evidence.