Study. uk . com
  1. Home
  2. All questions
  3. Question 508

CompTIA Security+ study material · question 508 of 611

What does chain of custody add that a verified hash does not?

  1. A record of every person who held the evidence and when
  2. Proof that the data has not been altered
  3. An index of the files the image contains
  4. An assurance that the collection tool was validated
Show the answer

Answer: A. A record of every person who held the evidence and when

The hash shows the data is unchanged; the custody record is what makes it admissible rather than merely accurate.

Source: NIST SP 800-86 (NIST) — SP 800-86 § 3.1.2 Acquiring the Data

Challenge yourself on this topic → Study as cards