The security manager received a report that an employee was involved in illegal activity and has saved data to
a workstation’s hard drive. During the investigation, local law enforcement’s criminal division confiscates the
hard drive as evidence. Which of the following forensic procedures is involved?
Chain of custody
Order of volatility
Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you
begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen
it, and where it has been.