Question

During the investigation of a suspected fraud incident, a security analyst copies key log files and a disk image from the affected server to a shared network folder so that several team members can review them simultaneously. The incident may later result in legal action against an employee. From an evidence-handling perspective, what is the MOST significant problem with the analyst's action?

Accepted Answer

Storing evidence in a shared, uncontrolled location breaks the chain of custody and undermines its admissibility

Answer

Copying the data consumes storage that could delay the recovery of the affected server

Answer

The analyst should have compressed the files first to reduce network bandwidth usage

Answer

Multiple reviewers will slow down the containment and eradication phases of the incident