During an incident response, which of the following is the BEST method to maintain the integrity of the evidence while transporting physical storage devices from a compromised system?
Using tamper-evident bags when transporting physical storage devices is the best practice for maintaining the chain of custody. This is because they provide a clear indication if any unauthorized access has occurred during transit. Using gloves only prevents fingerprints and antistatic bags are more for protecting components from ESD, not for security purposes. Labeling alone, while important, does not prevent tampering. Correct handling goes beyond simple labeling; it involves securing the evidence to protect it from physical tampering, which is achieved with the use of tamper-evident bags.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are tamper-evident bags and how do they work?
Open an interactive chat with Bash
Why is chain of custody important in incident response?
Open an interactive chat with Bash
What are the risks associated with improper handling of physical evidence?