What does evidence preservation require during a security incident?

• A. Maintaining continuity of evidence
• B. Sharing evidence publicly
• C. Ensuring the continuity, integrity, and chain of custody
• D. Deleting metadata after incident

Answer: (C)

Preserving evidence during a security incident relies on keeping an auditable, trustworthy trail from collection to analysis and potential presentation. The best practice is to ensure the continuity, integrity, and chain of custody of all evidence. Continuity means evidence stays in its original state from the moment it is collected through storage and examination, preventing loss or substitution. Integrity is about keeping the data unchanged and verifiable, often checked with hashes or checksums to prove it hasn’t been altered. Chain of custody provides a documented, time-stamped record of every person who handled the evidence, when, and for what purpose, preserving its admissibility and accountability. In practice, this involves forensic-friendly collection methods, creating exact copies, securely storing originals, and meticulously recording handling steps and timestamps. Sharing evidence publicly or deleting metadata would undermine confidentiality and the evidentiary value, whereas focusing only on continuity neglects the crucial aspects of integrity and the custody trail.