CHFI Computer Forensics Fundamentals and Process Practice Question
Which TWO of the following are essential components of chain of custody documentation?
⚠ Common exam trap
EC-Council often tests the distinction between what belongs in chain of custody documentation versus what belongs in the forensic analysis report or security procedures, leading candidates to mistakenly include analysis tools or storage specifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Every person who handled the evidence must sign and date the form
Option A is correct because chain of custody requires an unbroken, auditable record of possession, so every individual who handled the evidence must sign and date the form to establish accountability and continuity. Option B is correct because the evidence must be uniquely and precisely identified—including make, model, and serial number—so it can be distinguished from similar items and matched to the custody entries. Option C is not essential to chain of custody itself; the forensic tool used belongs to the analysis methodology and is documented in the examination report, not the custody log. Option D is not required; evidence must be secured against tampering, but a fireproof safe is a storage recommendation, not a chain-of-custody component. Option E is not part of chain of custody; the final analysis report documents findings and conclusions, not the chronological transfer and handling of the evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Every person who handled the evidence must sign and date the form
Why this is correct
Each individual who takes custody of the evidence must record their name, the date, and the time on the chain-of-custody form. This creates a chronological audit trail proving that the item was continuously controlled, so a court can presume no tampering occurred. If a single transfer lacks a signature and date, the chain is broken and the evidence may be excluded as lacking authenticity.
- ✓
A detailed description of the evidence including make, model, and serial number
Why this is correct
A chain-of-custody form must contain a specific physical description, including brand, model, and serial number, so the exact item can be matched to the document. This unique identification distinguishes the exhibit from similar-looking items and prevents claims that the evidence was switched or altered. The details serve as a fingerprint for the item, tying every later analysis back to the original seizure.
- ✗
The forensic tool used to analyze the evidence
Why it's wrong here
The forensic tool used for analysis is irrelevant to the custody record because chain of custody documents possession, not procedure. Tool names may be mentioned in an examination report to support the analyst's methodology, but they do not show who handled the evidence or when. Consequently, omitting tool information from the form neither breaks nor weakens the chain.
- ✗
The evidence must be stored in a fireproof safe
Why it's wrong here
While physical security measures like a fireproof safe protect evidence from damage and theft, they are storage practices rather than documenting control. Chain of custody exists as a written record with signatures, dates, and descriptions; no particular container is required by evidentiary rules. The lock or safe itself does not reveal the human hands through which the evidence passed.
- ✗
The final analysis report
Why it's wrong here
The final analysis report is an outcome of examination, not a component of the custody log. It contains conclusions, methods, and findings, whereas chain of custody tracks the item from collection through adjudication. Placing the report into the custody form would confuse scientific reporting with legal provenance and add information beyond the movement and handling history.
Go deeper
Related to this question
Learn chapter
Reporting, Documentation, and Expert Testimony
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.