Which of the following best describes an essential step in maintaining an admissible digital evidence during collection?

• A. Document the seizure and transfer only after analysis
• B. Immediately delete duplicates after imaging to save space
• C. Keep all copies on a personal device for convenience
• D. Maintain a documented chain of custody from seizure through storage

Answer: (D)

Maintaining a documented chain of custody from seizure through storage is essential because it proves who handled the digital evidence, when, and under what conditions, so the data’s integrity and authenticity can be trusted in court. This continuous record shows that the evidence has not been altered or tampered with since it was collected, which is a fundamental requirement for admissibility. In practice, this means every transfer, access, and storage action is logged, and the data is preserved on controlled, forensically sound media with verifiable hashes to confirm copies match the original. If any link in the chain is missing or compromised, the evidence’s provenance can be questioned, and it may be challenged or excluded.

Why the other ideas don’t fit: documenting seizure and transfer only after analysis introduces gaps in the record, making it harder to prove legitimate handling from the moment of collection; deleting duplicates after imaging risks losing evidentiary material and undermining integrity; relying on a personal device for copies risks uncontrolled access and breaks the chain of custody.