What is chain of custody in digital evidence?

• A. Documentation of who handled evidence, when, and how
• B. Ownership of the evidence by law
• C. How to store evidence physically
• D. Chain of custody is irrelevant to TA

Answer: (A)

Chain of custody for digital evidence is the documented history of how that evidence has been handled from collection onward. It records who handled it, when they did so, and how the evidence was preserved, transferred, or accessed, often including copies, hash verifications, and storage details. This trail helps prove the evidence hasn’t been altered and supports its reliability and admissibility by showing a transparent sequence of custody. Ownership by law is about legal rights to the item and isn’t the same as the procedural log of who touched the evidence. Storing it properly is important, but chain of custody covers every action and transfer, not just storage. It’s a fundamental practice in digital investigations, including for trusted agent work.