CHFI Computer Forensics Fundamentals and Process Practice Question
Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)
⚠ Common exam trap
CHFI often tests the distinction between chain of custody elements (who, when, signature) and forensic analysis details (tools, IP addresses, backup locations), so candidates mistakenly select options like A or E because they confuse the documentation of the evidence's handling with the technical steps of the investigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Date and time of evidence collection
The date and time of evidence collection is a fundamental element of chain of custody documentation, establishing a precise chronological record of when the evidence was acquired. This timestamp is critical for proving the integrity and continuity of the evidence from the moment of seizure, and it must be recorded with accuracy (often to the second) and in a consistent time zone (e.g., UTC) to avoid disputes. Without this, the chain of custody cannot demonstrate that the evidence was not tampered with between collection and analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IP address of the forensic workstation
Why it's wrong here
The IP address of the forensic workstation is an environmental detail, not a component of the chain of custody. Chain of custody records the possession, control, transfer, and analysis of the evidence item itself, not the network identity of the tools used. While the workstation's IP might appear in investigator notes or system logs, it does not help verify that the evidence was not altered or that its custody was continuous. Therefore, it is not a required element of a proper chain of custody form.
- ✗
Backup location of the evidence
Why it's wrong here
The backup location of the evidence is a storage detail, not an element of the chain of custody. Chain of custody establishes the authenticity of the original evidence by documenting each person who had possession and the time of transfer, but it does not track where redundant copies are stored. Backup locations are typically recorded in evidence storage or media management logs, separate from the chain of custody form. Consequently, it is not one of the essential components required for a legally sound chain of custody.
- ✓
Date and time of evidence collection
Why this is correct
The exact date and time of evidence collection is a cornerstone of chain of custody, as it creates an unambiguous chronological reference point. This timestamp, along with the location and the person collecting the evidence, establishes when the evidence first came into official custody. It allows the court to reconcile the evidence's timeline with investigator actions and to detect any gaps or irregularities. Without a precise date and time, the entire chain of custody could be challenged for lack of evidence integrity.
- ✓
Signature of the person handling the evidence
Why this is correct
The signature of each person who handles the evidence is a mandatory component because it provides individual accountability at every transition point. Signatures, as well as printed names sometimes, allow a prosecutor to identify who had possession at each stage and to call those witnesses to testify to their handling. Without a signature, the chain of custody breaks, and the evidence could be excluded as unauthenticated. This signature is distinct from the date/time, as it confirms not when the event occurred but who was responsible for it at that moment.
- ✗
The forensic tool used to analyze the evidence
Why it's wrong here
The forensic tool used to analyze the evidence is not a chain of custody component; rather, it is recorded in the examiner's notes, forensic report, or methodology documentation. Chain of custody focuses strictly on the movement and custody of the evidence item itself, not on the software or hardware used to inspect it. While tool selection can be critical for reproducibility and is often challenged under Daubert, that is a matter of scientific methodology, not custody continuity. Thus, it does not belong on a chain of custody form.
Go deeper
Related to this question
Learn chapter
Evidence Handling and Chain of Custody
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.