What is the purpose of maintaining chain of custody for evidence in a security investigation?

• A. To speed up the investigation
• B. To show a documented trail that the evidence has been preserved and unaltered
• C. To comply with a separate policy
• D. It is optional

Answer: (B)

Maintaining chain of custody creates an auditable, documented trail showing that evidence has been preserved in its original state and has not been altered since collection. This matters in security investigations because evidence may be used in court or presented to internal stakeholders, and if the chain of custody is broken, its integrity can be challenged or result in exclusion. A proper chain-of-custody log records who collected the item, every person who handled it, the times and dates, storage conditions, and any transfers between locations. For digital evidence, this is supported by hash verifications and documented imaging processes to confirm that the data remains unchanged. This isn’t about speeding up the investigation or merely following a policy; it protects the evidence’s credibility and ensures it can be relied upon. Thus, the purpose is to show a documented trail that the evidence has been preserved and unaltered.