問題文
A bank suspects that a departing employee copied customer lists onto a personal drive. Legal counsel expects the matter to reach court. Which handling practice most directly preserves the value of the evidence?
選択肢
- Ask the employee to describe what was copied and record the answer, because a statement from the person involved carries more weight in court than any technical record that the bank produces itself.
- Analyze the original drive directly so that the findings come from the source itself rather than from a copy, which removes any argument that the copying process altered what the analyst later reported.
- Delete the copies of the customer lists from the personal drive at once, so that the bank can show a regulator that the exposure of the customer data was ended as quickly as it possibly could be.
- Record an unbroken chain of custody that documents who held each item at what time and for what purpose from the moment of seizure through the analysis and into storage, with a signature at each handover.