Which of the following would be MOST important to guarantee that the computer evidence will be admissible in
court?

A.
It must prove a fact that is immaterial to the case.

B.
Its reliability must be proven.

C.
The process for producing it must be documented and repeatable.

D.
The chain of custody of the evidence must show who collected, secured, controlled, handled, transported
the evidence, and that it was not tampered with.

Explanation:
A chain of custody is a history that shows how evidence was collected, analyzed, transported, and preserved in
order to be presented in court. Because electronic evidence can be easily modified, a clearly defined chain of
custody demonstrates that the evidence is trustworthy.
Incorrect Answers:
A: The immateriality of the evidence is not the most important. It is more important to show how the evidence
was collected, analyzed, transported, and preserved. This is called the chain of custody.
B: The reliability of the evidence is not the most important. It is more important to show how the evidence was
collected, analyzed, transported, and preserved. This is called the chain of custody.
C: The process of producing the evidence is not the most important. It is more important to show how the
evidence was collected, analyzed, transported, and preserved. This is called the chain of custody.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1050