Evidence Handling and Chain of Custody

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Evidence Handling and Chain of Custody

Key Takeaways Explain This Topic AI

Digital evidence must be identified, collected, preserved, analyzed, and reported in a defensible, repeatable manner.

Chain of custody documents who handled evidence, when, where, why, and how it was protected from change.

Hashing (commonly SHA-256) at acquisition and before analysis proves a forensic copy has not changed.

A legal hold and write blocker stop spoliation by freezing data and preventing writes to the original media.

On SY0-701, the best evidence answer documents handling, prevents unauthorized change, and supports repeatable analysis.

Last updated: June 2026

Why Evidence Handling Matters on SY0-701

Digital forensics applies structured, defensible investigation methods to electronic evidence. CompTIA Security+ SY0-701 (the current edition, launched November 7, 2023, with a maximum of 90 questions, 90 minutes, and a passing score of 750 on a 100–900 scale) places forensics under Domain 4, Security Operations. The exam rarely tests deep tool syntax. Instead, it tests judgment: when a question describes a live incident, the best answer almost always protects evidence integrity before analysis begins .

Evidence that is altered, undocumented, or handled casually loses value even when it contains useful technical facts, because a defense attorney can argue it was tampered with.

The Evidence Handling Process

• Step Purpose Concrete example
• Identify Determine what may hold evidence Laptop, phone, EDR telemetry, cloud audit logs, firewall logs
• Collect Acquire using approved, documented methods Disk image, memory capture, signed log export
• Preserve Protect from any change Write blocker, evidence bag, Faraday bag for phones, access control
• Analyze Examine working copies, never originals Mount the image read-only, parse logs, inspect artifacts
• Report Explain findings, methods, and limits Timeline, tool versions, hashes, conclusions
• Legal Hold and Spoliation

A legal hold (litigation hold) is a formal directive to preserve all data relevant to anticipated or active litigation. Once issued, routine deletion and log rotation must stop for the in-scope systems. Failing to preserve data is spoliation , which can trigger court sanctions or an adverse-inference ruling. E-discovery is the legal process of identifying and producing electronically stored information in response to a subpoena or discovery request. Security+ pairs these terms with chain of custody because together they make evidence usable in court.

Chain of Custody

Chain of custody is the documented, unbroken history of evidence handling. It must show who held the item, when they received it, where it was stored, what they did, and to whom they transferred it. Any gap lets opposing counsel argue the evidence could have been altered.

• Field Example value
• Evidence ID E-2026-0429-003
• Description Dell laptop, user mlee, serial 7XQ914
• Collected by J. Patel
• Date / time 2026-04-29 14:22 PDT
• Location Finance office, desk 18
• Condition Powered on, screen locked, on dock
• Action Photographed, RAM captured, disk imaged
• Hash SHA-256 of forensic image recorded
• Transfer Released to evidence locker at 16:10 PDT
• Hashing and Integrity

A hash is a fixed-length value computed from data; changing even one bit changes the hash. Investigators record a hash at acquisition and recompute it before analysis and before testimony. A matching hash demonstrates the working copy is bit-for-bit identical to the source. Evidence ID: E-2026-0429-003

• Source hash (SSD): 5f2a9c...b81c (SHA-256)
• Image hash: 5f2a9c...b81c (SHA-256)
• Verified: at acquisition AND before analysis = MATCH

A write blocker (hardware or software) sits between the source drive and the workstation, allowing reads but silently dropping any write so the original cannot change during imaging.

Provenance, Acquisition, and Preservation

SY0-701 groups several closely related terms you must keep straight. Acquisition is the act of obtaining a forensic copy of the data. Preservation is protecting that data and the original from any change after acquisition. Provenance is the documented origin and history of a piece of evidence — essentially the chain of custody applied to a single artifact, proving where it came from and that it is authentic. Data integrity is the property that the evidence has not been altered, which is exactly what hashing proves.

Non-repudiation is the assurance that an actor cannot deny an action; in forensics, signed logs and verified hashes support it. Expect a scenario question that hands you all five terms as distractor options and asks which one a given control (a write blocker, a SHA-256 verification, an evidence bag) actually delivers.

Worked Scenario

A finance analyst reports spreadsheets were changed without approval. The responder photographs the desk, records that the laptop is powered on, captures volatile memory first (the machine is running), exports the cloud file-repository audit logs, then images the SSD through a write blocker and hashes it. The original is sealed in a tamper-evident evidence bag and logged into the locker. All analysis runs on the verified copy. Notice the sequence: photograph and document, capture volatile data, then image — the order itself is a defensible decision the report must justify.

If counsel later challenges the image, the responder produces the matching SHA-256 values and the unbroken custody log to rebut any tampering claim.

Right to Audit and Third Parties

When evidence lives with a cloud provider or managed service, a right-to-audit clause in the contract gives the customer (or its investigators) the contractual ability to inspect logs and request data. Without it, you may be unable to obtain the very audit logs your timeline depends on. This is why Security+ ties forensics back to vendor management and service-level agreements: you cannot preserve what you have no legal access to, and you cannot subpoena a provider's records as quickly as you can pull your own.

Common Traps

Analyzing the original drive when a forensic copy is possible.

Forgetting to log who transferred the evidence (broken chain).

Failing to hash before analysis, so integrity cannot be proven later.

Powering off a running host without capturing volatile data first.

Mixing evidence from different cases without unique labels.

Leaving evidence in an unlocked drawer or a personal cloud folder.

Ignoring a legal hold and letting log rotation delete relevant data (spoliation).