Which practice most directly supports evidence integrity in digital forensics?

• A. Maintaining a documented chain of custody and using verified hash values to confirm integrity.
• B. Relying on the investigator's memory of the process.
• C. Deleting original media after collection to protect privacy.
• D. Only recording evidence in a spreadsheet.

Answer: (B)

Preserving evidence integrity hinges on an auditable, verifiable trail of handling and on ensuring the data hasn’t been altered. A documented chain of custody records every transfer, copy, and access, including who performed it and when, creating accountability and a way to prove the evidence remained intact throughout the investigation. Pair that with verified hash values—cryptographic digests computed at collection and re-checked at every stage—so any change to the data would produce a different hash, signaling tampering or corruption. Relying on memory is unreliable, deleting original media can destroy crucial evidence, and recording only in a spreadsheet fails to provide tamper-evidence or a complete, verifiable trail. Together, chain of custody and hashing offer the strongest safeguard for evidence integrity in digital forensics.