Guide on Evidence Handling and Procedures

Importance: Evidence Handling and Procedures form a critical part of any legal investigation in information security, particularly in situations involving breaches or potential criminal activity. Mishandled evidence can compromise cases and result in legal setbacks.

What it is: Evidence Handling and Procedures refers to the proper approach to collection, documentation, storage, and preservation of evidence in legal investigations tied to information security. This includes accurate recording of its origin, strict adherence to chain of custody protocols, and maintaining its integrity until formally required.

How it works: Evidence is first identified and then collected using forensically sound methods. It is documented meticulously, including its origin, the person collecting it, and any actions taken. The evidence is then stored and preserved securely to maintain its integrity, and a strict chain of custody is maintained to ensure it hasn't been tampered with.

How to answer questions in an exam: Familiarize yourself with core principles of evidence handling, such as the importance of the chain of custody, baseline knowledge of local legislation, and the need for proper documentation. Understand the difference between volatile and non-volatile evidence, and the appropriate methods for collecting and preserving each.

Exam Tips - Answering Questions on Evidence Handling and Procedures: Remember that maintaining the integrity of the evidence is paramount. Any hint of tampering or mishandling will render the evidence useless in a court of law. Be aware that some questions might try to trick you into selecting an answer that involves improper handling or storage techniques. Stick to the principles of strict documentation and adherence to chain of custody.