In documenting digital evidence, which elements are essential to demonstrate authenticity and chain of custody?

• A. Data content and file size only.
• B. The observer's impression.
• C. Chain of custody and preservation of originals.
• D. Device color and model.

Answer: (C)

Authenticity in digital evidence hinges on keeping a clear, unbroken record of how the item was handled and ensuring the original data stays intact. The chain of custody provides a documented, chronological trail showing every person who handled the evidence, when, and for what purpose, so there are no unexplained gaps that could suggest tampering. Preservation of originals means the actual data remains unaltered and is safeguarded; forensic best practices use verified images, write-blockers, secure storage, and integrity checks (like hashes) to prove the copy remains a faithful representation of the original. Together, these elements prove that the evidence presented is the same as what was collected and has not been modified, which is essential for admissibility and credibility. Data content or file size alone does not establish provenance or integrity, an observer’s impression is not objective, and device color or model has no relevance to authenticity.