CompTIA Security+ (SY0-601) — Question 712

During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the following BEST explains this reasoning?

Answer options

• A. The forensic investigator forgot to run a checksum on the disk image after creation.
• B. The chain of custody form did not note time zone offsets between transportation regions.
• C. The computer was turned off, and a RAM image could not be taken at the same time.
• D. The hard drive was not properly kept in an antistatic bag when it was moved.

Correct answer: B

Explanation

The correct answer, B, highlights the significance of accurately documenting time zone offsets in the chain of custody, as this can impact the integrity of the evidence. Options A, C, and D, while they point out procedural oversights, do not address the critical issue of how time zone discrepancies could affect the admissibility of the evidence in court.