Section 4.5 Key aspects of digital forensics

Question 1

What protects any documents that can be used in evidence from being altered or destroyed? Sometimes called a litigation hold.

Answer 1

Legal Hold

Question 2

What tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle? Documents each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.

Answer 2

Chain of Custody