What is the recommended handling of the original evidence after creating copies and hashes?

• A. Leave it untouched and store securely
• B. Keep it connected to a live system
• C. Use it for further testing in the field
• D. Erase it after analysis

Answer: (A)

Preserving evidence integrity and maintaining a solid chain of custody require that the original media remain unchanged after imaging and hashing. Once you’ve created verified copies and computed hash values, those hashes prove the copies are exact reproductions of the original, so any modification to the original could invalidate the evidence and undermine admissibility. Therefore, the original should be left untouched and stored securely—in a controlled environment with tamper-evident seals, strict access controls, and proper logging.

Keeping the original connected to a live system risks ongoing changes and potential tampering. Using the original for further testing in the field risks altering data. Erasing it would destroy the evidence entirely. In short, the best practice is to leave the original untouched and store it securely.