GIAC Certified Incident Handler (GCIH) — Question 39

What information is commonly found in both the header and the possession log of a Chain of Custody?

Answer options

• A. Date and time the evidence was requested by the court
• B. Date and time the evidence was checked into evidence locker
• C. Date and time the evidence was initially collected
• D. Date and time the evidence is classified as reliable

Correct answer: B

Explanation

The correct answer is B because the possession log specifically records when the evidence is checked into the evidence locker, which is crucial for maintaining the integrity of the chain of custody. Options A, C, and D refer to events that may not be consistently documented in both the header and possession log, making them incorrect in this context.