Documenting Chain of Custody for Evidence Admissibility
A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?
Quick Answer
The correct answer is to record each transfer with date, time, handler name, and signatures because this practice forms the backbone of chain of custody documentation, which is a legal process that tracks every instance of evidence handling to prove its integrity. Without this meticulous log, any break in the documented possession chain can render evidence inadmissible in court, as opposing counsel could argue tampering or contamination. On the Security+ SY0-701 exam, this concept tests your understanding of forensic procedures and evidence admissibility, often appearing in scenario-based questions where a single missing signature or unrecorded transfer is the trap. A common memory tip is to think of the chain of custody as a “paper trail handcuff” — every link (transfer) must be locked with a handler’s name, date, time, and signature to keep the evidence secure.
⚠ Common exam trap
CompTIA often tests the misconception that preserving evidence means making it easier to access (like resetting or removing components), when in fact the priority is maintaining the original state and documenting every touchpoint to ensure legal admissibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Record each transfer with date, time, handler name, and signatures.
Chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the laptop on a desk until the investigator is available.
Why it's wrong here
Leaving evidence unattended creates gaps in accountability and increases the chance of tampering or dispute later.
- ✓
Record each transfer with date, time, handler name, and signatures.
Why this is correct
Chain of custody requires a documented record of who handled the evidence, when it changed hands, and under what conditions. These records help prove integrity and admissibility later. Accurate transfer documentation is one of the most important parts of evidence handling in a forensic case.
- ✗
Reset the laptop so the legal team can access it more easily.
Why it's wrong here
Resetting the device destroys data and changes the evidence. That would undermine the investigation and could make the device less useful in court.
- ✗
Remove the hard drive and connect it to a personal workstation.
Why it's wrong here
Using an unapproved workstation risks altering evidence and breaks proper evidence-handling procedures. Forensic collection should use controlled, documented methods.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?
medium- A.Browse the drive directly on the original laptop to identify the most relevant files.
- ✓ B.Create a forensic image using a write blocker and record hash values.
- C.Email the user asking them to return any copies they may have made.
- D.Mount the drive read-write so searching and exporting data will be faster.
Why B: Creating a forensic image with a write blocker ensures the original evidence remains unaltered, preserving its integrity for court admissibility. Recording hash values (e.g., SHA-256) provides a cryptographic fingerprint that can later verify the image is an exact copy, meeting legal standards for chain of custody and authenticity.
Variation 2. A company-owned laptop is suspected in an insider theft case and legal says the evidence may be used in court. Which two actions best support evidence admissibility during transport to the evidence locker? Select two.
medium- ✓ A.Document the chain of custody with the collector, date, time, device condition, and transfer history.
- ✓ B.Place the laptop in a tamper-evident bag or seal and record the seal number.
- C.Browse the user’s files to confirm whether the laptop contains stolen documents.
- D.Remove the hard drive and place it in an unmarked box for convenience.
- E.Let the employee continue using the laptop until legal staff are available.
Why A: Both actions protect the integrity and evidentiary value of the laptop. Chain-of-custody documentation creates a continuous, verifiable record of every transfer, showing who had control and that the device was not altered. Sealing the laptop in a tamper-evident bag and recording the seal number physically prevents or indicates tampering during transport and ties the evidence to the documented custody transfer. Together, they establish authenticity and integrity for admissibility.
Variation 3. An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?
medium- A.Boot the laptop normally and browse the user's files for clues
- ✓ B.Create a forensic image through a write blocker and record hashes before and after acquisition
- C.Copy the user's documents to a USB drive and continue the investigation later
- D.Take screenshots of the desktop and delete the original drive contents afterward
Why B: Creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.