Following an incident, an administrator is gathering forensic evidence from a server for a human resources investigation. Which of the following best practices is MOST important to document throughout the process to maintain integrity of the findings?
A) Acceptable use policy violations
B) Server configuration
C) Chain of custody
D) Data loss incidents

Question

Quizplus · Accepted Answer

Documenting the chain of custody is crucial to maintain the integrity of the evidence, ensuring that it is accounted for at all times and has not been tampered with.

Following an Incident, an Administrator Is Gathering Forensic Evidence from a Server