Which practice supports proper evidence collection for digital materials?

Which practice supports proper evidence collection for digital materials?

• A. Copy data and edit for clarity
• B. Delete originals after copying, use any tool, skip documentation, preserve only modified copies
• C. Keep copies on local computer only
• D. Preserve original copies, use verified tools, document steps, maintain chain of custody, avoid altering data

Answer: (D)

Proper digital evidence collection hinges on preserving the original data, using verified, trusted tools, documenting every action taken, and maintaining an unbroken chain of custody. By keeping the original copies intact and handling them with validated forensic software or hardware, you ensure the data isn’t altered during collection. Documenting each step—what was done, with which tools, and when—creates a transparent audit trail that others can follow. Maintaining chain of custody shows who handled the evidence, when, and for what purpose, which is essential for authenticity and admissibility in any proceeding. Avoid altering data in any way, since edits can change content or metadata and undermine integrity.

If you copy data and edit it for readability, you risk changing the material you’re trying to prove. Deleting originals after copying eliminates the source of truth and breaks the chain of custody. Keeping copies only on a local computer lacks redundancy, control, and proper logging, making tampering or loss more likely. Using unverified tools or skipping documentation also undermines reliability and the ability to reproduce results.