Computer Hacking Forensic Investigator (CHFI v10) — Question 144

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

Answer options

• A. rules of evidence
• B. law of probability
• C. chain of custody
• D. policy of separation

Correct answer: C

Explanation

The correct answer, 'chain of custody', refers to the documented process that tracks the handling of evidence to ensure its integrity in legal contexts. The other options do not pertain to the specific tracking and documentation of evidence; 'rules of evidence' relate to what is admissible in court, 'law of probability' deals with likelihood assessments, and 'policy of separation' is not relevant in this context.