Exam SY0-601 topic 1 question 183 discussion

Answer: Chain of custody A chain of custody is a chronological paper trail documenting when, how, and by whom individual items of physical or electronic evidence—such as cell phone logs—were collected, handled, analyzed, or otherwise controlled during an investigation. ======================== Helpful info Order of Volatility -the sequence or order in which the digital evidence is collected. The order is maintained from highly volatile to less volatile data. Highly volatile data resides in the memory, cache, or CPU registers, and it will be lost as soon as the power to the computer is turned off. Non-repudiation - the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity, so neither can later deny having processed the information. Admissibility - the quality of being acceptable or valid, especially as evidence in a court of law.

B. Chain of custody

The process of documenting who has access to evidence and maintaining a record of its movement and handling is known as the chain of custody. It is a crucial process in digital forensics and legal investigations to ensure the integrity and admissibility of the evidence in a court of law. By documenting the chain of custody, investigators can establish that the evidence has not been tampered with and that it can be trusted as valid and reliable.

Chain of custody is the obvious answer, but the wording is so dumb on some of these. Access is not the same as possession.

I think all responses are not correct, but the least false is reponse C (Chain of custody). The chain of custody is not limited to tell who has access to why. It describes many things such as who had access, when, why, and so on. It's used for forensic investigation. The other responses are totally false.

Chain of custody, B

Chain of custody