Which practice supports proper evidence collection for digital materials?

• A. Copy data and edit for clarity
• B. Delete originals after copying, use any tool, skip documentation, preserve only modified copies
• C. Keep copies on local computer only
• D. Preserve original copies, use verified tools, document steps, maintain chain of custody, avoid altering data

Answer: (D)

The main idea is preserving the original digital material and creating a verifiable, repeatable record of how it was handled. Proper evidence collection relies on keeping the original copies intact, using tools that are proven for forensic work, documenting every step (tool versions, settings, dates, and who performed each action), and maintaining a clear chain of custody showing who accessed or moved the data and when. This approach ensures the data hasn’t been altered, provides a trustworthy audit trail, and supports admissibility and reproducibility.

Why this works better than alternatives: changing data or editing for clarity can alter the evidence or misrepresent its state; deleting originals after copying or skipping documentation breaks the ability to prove the original condition or who handled it; relying only on local copies without a documented process risks loss of data and untraceable handling.