Which practice is part of proper handling and preservation of digital evidence?

• A. Leaving the device unattended
• B. Failing to document events
• C. Seizure with minimal alteration
• D. Ignoring hash verification

Answer: (C)

Preserving digital evidence means keeping the data as close to its original state as possible so it remains credible in court. Seizure with minimal alteration is the best fit because it centers on gathering the device without introducing changes that could taint the evidence. This approach supports a forensically sound image of the data, maintains a clear chain of custody, and minimizes the risk of altering files, metadata, or timestamps. It also typically involves steps like securing the device, avoiding unnecessary powering on, and using proper techniques and tools to capture the data, so investigators can later verify integrity.

Hash verification plays a crucial role in this process, as calculating and comparing cryptographic hashes on the original and the image helps confirm that no changes occurred during collection or subsequent handling. The other options undermine integrity or custody: leaving the device unattended opens the door to tampering or accidental modification; failing to document events breaks the chain of custody and makes it hard to prove authenticity; ignoring hash verification means you have no reliable way to prove the data hasn’t changed.