Which of the following is LEAST necessary when creating evidence tags detailing the chain of
custody for electronic evidence?

A.
The mode and means of transportation.

B.
Notifying the person who owns the information being seized.

C.
Complete description of the evidence, including quality if necessary.

D.
Who received the evidence.

Explanation:
The references indicate that transportation is important.
Each piece of evidence should be marked in some way with the date, time, initials of the collector,
and a case number if one has been assigned…The pieces of evidence should then be sealed in a
container and the container should be marked with the same information. The container should be
sealed with evidence tape and if possible, the writing should be on the tape so a broken seal can
be detected. – Shon Harris All-in-one CISSP Certification Guide pg 673
In many cases, it is not possible for a witness to uniquely identify an object in court. In those

cases, a chain of evidence must be established. This involves everyone who handles evidence -including the police who originally collect it, the evidence technicians who process it, and the
lawyers who use it in court. The location of the evidence must be fully documented from the
moment it was collected to the moment it appears in court to ensure that it is indeed the same
item. This requires thorough labeling of evidence and comprehensive logs noting who had access
to the evidence at specific times and the reasons they required such access.” Pg. 593 Tittel:
CISSP Study Guide.
The evidence life cycle covers the evidence gathering and application process. This life cycle has
the following components:
Discovery and recognition
Protection
Recording
Collection
Collect all relevant storage media
Make image of hard disk before removing power
Print out screen
Avoid degaussing equipment
Identification
Preservation
Protect magnetic media from erasure
Store in proper environment
Transportation
Presentation in a court of law
Return of evidence to owner
Pg. 309 Krutz: The CISSP Prep Guide
The life cycle of evidence includes
* Collection and identification
* Storage, preservation, and transportation
* Presentation in court
* Being returned to victim or owner
Pg 677 Shon Harris: All-In-One CISSP Certification Exam Guide