In handling sensitive information, what is the purpose of a chain of custody?

• A. A plan for encrypting data in transit.
• B. A policy prohibiting data sharing.
• C. The documented, traceable transfer of evidence or data to preserve integrity and admissibility.
• D. A method for anonymizing data.

Answer: (C)

The key idea is to maintain a documented, traceable record of who handled evidence or data from collection through all transfers and storage, so its integrity and authenticity can be trusted. This chain of custody creates a clear history showing where the item has been, who has accessed it, and why, with time stamps and handling details. In digital contexts, this often includes custody logs and cryptographic hashes that must match at each transfer or access, ensuring the data hasn’t been altered. This traceability is what makes evidence or sensitive information admissible and credible in investigations or formal proceedings.

For example, when a laptop or digital file is collected, an initial hash is recorded, and every move or access is logged by the people who handle it, with timestamps and purposes noted. If a later analysis shows a mismatch in hashes or a gap in the log, it signals potential tampering or loss of integrity.

Encrypting data in transit focuses on security during transmission, not on proving who handled the data or preserving its untampered state. Prohibiting data sharing is about access control, not documenting the item’s custody. Anonymizing data changes identifiability, not the record of custody itself.