How is evidence integrity preserved in electronic investigations?

• A. Preserve digital fingerprints, use write-blockers, document chain of custody, limit access, and coordinate with digital forensics.
• B. Delete originals after copying evidence.
• C. Share access with all personnel.
• D. Do not document chain of custody.

Answer: (A)

In electronic investigations, preserving evidence integrity means keeping data exactly as it was from the moment of collection through analysis and potential legal proceedings. The best approach includes creating and preserving digital fingerprints (hash values) so you can verify copies are exact matches to the originals, using write-blockers during acquisition to prevent any accidental modification of the source, and documenting a clear chain of custody that records every person who handled the evidence, when, and what was done. Limiting access helps prevent unauthorized changes, and coordinating with digital forensics professionals ensures adherence to proper procedures and standards. Together, these practices maintain verifiability and admissibility by showing the evidence has remained unaltered and traceable. Deleting originals after copying would destroy the true source and undermine verification; sharing access with everyone increases tampering risk; and not documenting the chain of custody breaks the traceability needed to prove proper handling.