Which of the following is a documentation of guidelines that computer forensics experts use to
handle evidences?

A.
Evidence access policy

B.
Incident response policy

C.
Chain of custody

D.
Chain of evidence

Explanation:
A chain of custody is a documentation that shows who has collected and accessed each piece of
evidence. The documentation must be meticulously prepared including the minutest details (such as
the date, time, location, and the verified identity of every person handling the evidence) so that the
documentation is verifiable. It includes the time of accessing the evidence and the valid reason for
doing so. A chain of custody must be maintained for all evidences in order to maintain the validity of
the evidences.
Answer option B is incorrect. Incident response policy is a document that defines an incident and
helps people to respond appropriately to that incident. It provides information about people who
are responsible for handling security incidents and how they can be contacted. The
incident response policy also provides instructions to deal with documenting and disseminating
incident-related information.
TechNet, Contents. “Data Security and Data Availability in the Administrative Authority”