CHFI Computer Forensics Lab Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Require biometric authentication for all lab personnel

  Why it's wrong here

  Biometric authentication verifies the identity of personnel attempting to access lab systems or evidence storage, but it does not track the movement of specific evidence items. A chain of custody requires a documented chronological history of each transfer, including who released and who received the evidence, with timestamps. Biometric access logs may show who entered a room, but they do not establish custody over a particular digital exhibit or forensic image. Therefore, while useful for access control, it is not a substitute for custody documentation.

• ✗

  Store evidence in a secure room with limited access

  Why it's wrong here

  Restricting physical access to a secure evidence room reduces the risk of unauthorized tampering, yet it fails to document the individual who handled a specific piece of evidence at any given moment. Chain-of-custody protocols mandate a written or electronic log recording each removal, transfer, and return of evidence, along with the identities and signatures of the custodians. A limited-access policy alone cannot prove that the evidence has not been altered between collection and presentation in court. Physical security is a complementary control, not a custody record.

• ✗

  Use encryption to protect evidence files

  Why it's wrong here

  Encryption protects the confidentiality and integrity of digital evidence while at rest or in transit, but it does not generate an auditable record of human custody. The chain of custody traces possession and control of the physical or logical evidence object, requiring signatures and timestamps for every change of hands. An encrypted container might preserve the evidence's content, but it cannot show who accessed the decrypted copy or when a forensic image was transferred. Thus, crypto safeguards data, while custody documentation safeguards legal admissibility.

• ✓

  Document every transfer of evidence with signatures and timestamps

  Why this is correct

  Proper chain-of-custody documentation requires an unbroken chronological record that identifies every individual who had control of the evidence, the exact date and time of each transfer, and the reason for the transfer. Each exchange must be signed by both the releasing and receiving custodians to verify that the evidence was in their possession and was not unaccounted for. This documentation is pivotal in court to demonstrate that the evidence is authentic and has not been substituted, altered, or tampered with. Without signatures and timestamps, a court may deem the evidence inadmissible on the grounds of a broken custody chain.

Go deeper

Related to this question