Computer Hacking Forensic Investigator (CHFI) — Question 98
In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?
Answer options
- A. rules of evidence
- B. law of probability
- C. chain of custody
- D. policy of separation
Correct answer: C
Explanation
The correct answer is 'chain of custody' because it specifically refers to the documentation and handling of evidence to maintain its integrity throughout an investigation. The other options do not pertain to the tracking of evidence; 'rules of evidence' relate to admissibility in court, 'law of probability' deals with statistical likelihoods, and 'policy of separation' is not a recognized term in this context.