What is the purpose of an evidence log in an incident response?

• A. To hide details from investigators
• B. To replace chain-of-custody
• C. To record all communications and actions taken for accountability
• D. To be kept only for personal reference

Answer: (C)

In incident response, an evidence log is about creating a complete, time-stamped record of everything that happens with evidence. This means tracking who collected or handled evidence, when and where it was moved or stored, what tools or methods were used, and every communication or decision made about the evidence. This ongoing documentation makes the investigation transparent and auditable, so anyone reviewing it can understand exactly what occurred, verify that procedures were followed, and determine if any steps were missed or mishandled.

The log supports, but does not replace, the chain-of-custody process by recording custody transfers and handling procedures, which helps prove the integrity of the evidence over time. It also ensures the information isn’t just for one investigator’s memory but is a formal record that can be examined later, shared with relevant parties, and used in legal or compliance contexts if needed.

It’s not meant to hide details, and it isn’t something kept only for personal reference. The purpose is clear: to capture all communications and actions for accountability and traceability throughout the incident response.