What are essential elements of evidence chain of custody during incident response?

• A. Documentation of who collected evidence, when, how stored, access control, transfers; preserves integrity with hashes, etc.
• B. You do not need to preserve how evidence was stored.
• C. It involves only signing receipts.
• D. Chain-of-custody is only about legal holds.

Answer: (A)

Maintaining a proper chain of custody is about documenting every step the evidence takes from collection to presentation so its integrity and origin can be trusted. The essential elements include recording who collected the evidence, when it was collected, and where it is stored, along with how access is controlled and how any transfers are handled. You capture each handoff with dates, times, and who is involved, and you use secure, controlled storage with tamper-evident measures and clear access controls so only authorized personnel can reach it. To preserve integrity, you generate and compare hash values or checksums at collection and after every transfer, using trusted tools and audit logs to verify the item hasn’t been altered. This combination makes the evidence auditable and defensible, which is crucial for accurate reconstruction of the incident and, if needed, legal admissibility.

Other options don’t fit because they omit critical pieces: storage details matter for integrity and traceability, not just a signature; keeping only a receipt doesn’t address ongoing custody, transfer records, or integrity verification; and limiting chain-of-custody to legal holds misses the broader, practical need to document handling and verification throughout an investigation.