What is the purpose of protecting evidence and preserving chain of custody during an incident?

• A. Delete all evidence after analysis.
• B. Share evidence with the public.
• C. Use evidence only for internal memos.
• D. Protect evidence and preserve chain of custody for admissibility and investigation.

Answer: (D)

Preserving evidence and maintaining chain of custody is about keeping digital artifacts trustworthy and usable for investigation and potential legal action. When evidence is collected, every transfer, handling step, and storage location must be documented so who touched it, when, and how it was protected is clear. This prevents tampering, alteration, or loss, which could otherwise render the evidence unreliable or inadmissible in court or formal inquiries. A sound chain of custody also helps establish a clear timeline, supports forensic analysis by preserving original data, and ensures the information can be used for regulatory reporting, accountability, and lessons learned from the incident. Deleting evidence, exposing it publicly, or restricting it to internal memos would compromise its integrity and usefulness.