What constitutes proper evidence handling during an incident investigation in a TA scenario?

• A. Collect, preserve, document, and maintain chain of custody
• B. Delete evidence after analysis
• C. Share raw data publicly
• D. Modify timestamps to align with events

Answer: (A)

The fundamental idea is preserving evidence integrity throughout the investigation by collecting it properly, keeping it unaltered, documenting every step, and maintaining an unbroken chain of custody. This starts with obtaining evidence in a forensically sound manner—using appropriate tools and methods that prevent changes to the original data, and generating verifiable hashes before and after the copy so you can prove the data hasn’t been altered. Then comes meticulous documentation: record who collected the evidence, when and where it was collected, and exactly how, plus keep a detailed chain-of-custody log as the evidence moves between people, places, and repositories. The original material should be stored securely with restricted access, while analysts work on verified copies, ensuring any handling is auditable and the original remains intact. This approach protects the evidence’s reliability and helps establish a trustworthy, reproducible timeline of events.

Deleting evidence erases critical information and undermines the investigation. Sharing raw data publicly risks privacy and contaminates the evidence. Modifying timestamps distorts the timeline and breaks the integrity trail.