Certified Incident Handler (CIH) Practice Ecam

In a chain of custody document, where does a first responder record details about the individual handling electronic evidence?

1. Proof of Ownership

2. Address and Telephone Number

3. Incident Date

4. Witness Information

The correct answer is: Address and Telephone Number

The correct answer focuses on the documentation surrounding individuals who come into contact with electronic evidence during an incident. In a chain of custody document, it is essential to provide clear and precise details regarding all individuals involved in the handling of the evidence to maintain accountability and traceability. Recording the address and telephone number of the individual handling the electronic evidence ensures that there is a reliable means of communication and identification should any questions or issues arise regarding the evidence later on. This level of detail supports the integrity of the evidence and helps to prevent any disputes over its handling. The other elements in the chain of custody document serve different purposes. Proof of ownership is related to establishing who owns the evidence rather than who handled it. The incident date pertains to when the incident occurred rather than personal details of those involved. Witness information includes names and potentially statements from witnesses but does not specifically focus on the individuals directly involved in handling the evidence. Thus, the requirement for clear documentation about the handling individuals is met best by detailing their address and telephone number.