Crucial Technologies is conducting post-incident forensics after a possible compromise of a system. Before the system gets to its destination it will pass through numerous employees in the IT department. What document needs to be updated with the system as it makes its way to the proper section?
Correct Incorrect Unanswered
Answer Description
The answer is chain of custody. Chain of custody is the process of documenting each person that has possession of an object at all times. The chain of custody must be updated with each person that handles the system with the time/date possession began and ended.. This is required to maintain the integrity of the forensics process.
Wikipedia
Chain of custody (CoC), in legal contexts, is the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of materials, including physical or electronic evidence. Of particular importance in criminal cases, the concept is also applied in civil litigation and more broadly in drug testing of athletes and in supply chain management, e.g. to improve the traceability of food products, or to provide assurances that wood products originate from sustainably managed forests. It is often a tedious process that has been required for evidence to be shown legally in court. Now, however, with new portable technology that allows accurate laboratory quality results from the scene of the crime, the chain of custody is often much shorter which means evidence can be processed for court much faster.
The term is also sometimes used in the fields of history, art history, and archives as a synonym for provenance (meaning the chronology of the ownership, custody or location of a historical object, document or group of documents), which may be an important factor in determining authenticity.
Chain_of_custody - Wikipedia, the free encyclopedia 