How should digital evidence be stored to protect integrity?

• A. Store on publicly accessible servers for convenience.
• B. Allow anyone to modify metadata with no logs.
• C. Use secure, access-controlled storage; maintain hash/checksum records; limit modification; back up copies.
• D. Delete hash records to simplify management.

Answer: (C)

Protecting the integrity of digital evidence comes from secure, controlled storage combined with verifiable records that prove nothing has been altered. Use storage that is protected against unauthorized access—encryption at rest, strong authentication, and strict access controls—and keep a detailed audit trail of everyone who handles the data. Recording a cryptographic hash or checksum when the evidence is collected and re-checking that hash whenever the data is accessed or moved creates an ongoing defense against tampering; it provides a way to detect any change.

Limit who can modify the evidence or its metadata, and require documentation and justification for any needed changes. Implement write protections, versioning, and tamper-evident practices so that legitimate updates are tracked and reversible if necessary. Keep backup copies as well, stored in separate, secure locations, and consider immutable or WORM storage to prevent alteration after creation. Regularly verify backups and hash values to ensure copies remain faithful to the original.

Storing on publicly accessible servers, allowing metadata edits without logs, or deleting hash records undermines trust in the evidence. Public access increases risk of tampering and exposure; unlogged metadata changes erase the chain of custody; and removing hash records eliminates the ability to prove integrity over time.