Question

During a fraud investigation, a forensic analyst images a suspect's hard drive and later hands the copy to a second analyst for review. Weeks afterward, the defense challenges whether the evidence was altered while in storage. Which practice would MOST directly refute this challenge and support the evidence's admissibility in court?

Accepted Answer

A complete chain-of-custody log documenting every person who handled the evidence, along with dates, times, and purposes

Answer

A signed nondisclosure agreement from both analysts covering the case data

Answer

Encryption of the forensic image with a key held by the lead investigator

Answer

A written incident response plan approved by senior management before the investigation began