What is the appropriate method to store and transfer digital evidence (logs, emails) related to an incident?

• A. Use chain-of-custody procedures, preserve original data, log all transfers, and store in approved, access-controlled repositories
• B. Copy data freely and store in personal drives
• C. Delete original data after transfer
• D. Store data in public cloud without logs

Answer: (A)

Maintaining the integrity and traceability of digital evidence through chain-of-custody and controlled storage is the core idea. The best approach requires following chain-of-custody procedures, preserving the original data in its unchanged form, and logging every transfer or access. Stored in approved, access-controlled repositories, this creates a verifiable audit trail showing who handled the data, when, and under what conditions. It often involves capturing a cryptographic hash of files at collection, documenting each step of custody, and restricting access to authorized personnel. This combination protects against tampering, loss, or unauthorized exposure and helps ensure the evidence remains admissible and credible.

Copying data freely to personal drives introduces risk of alteration and makes it impossible to prove provenance. Deleting the original data after transfer removes the ability to verify authenticity. Storing data in a public cloud without logs eliminates the necessary audit trail and controls.