SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/aplus-chain-of-custody

In incident response, what does chain of custody document?

Who handled the evidence, and when.

Start playing free

  1. The price of the equipment
  2. Every person who handled the evidence, with date and time ✔
  3. The passwords on the device

Why: Chain of custody tracks the movement of evidence from collection to analysis. It records each person who handled it, when, and why it moved.

Huh, didn't know that: NIST says it covers collection, safeguarding and analysis of evidence.

The dad joke
Chain of custody: the only chain that's good when it's unbroken.
Like this card?
Play the game

References

Answer: Every person who handled the evidence, with date and time. Chain of custody tracks the movement of evidence from collection to analysis. It records each person who handled it, when, and why it moved.

  1. Chain of custody, NIST CSRC glossary csrc.nist.gov/glossary/term/chain_of_custody
    documenting each person who handled the evidence
    Checked 2026-10-11.
  2. CompTIA A+ Core 2 (220-1202) Exam Objectives v1.1 lecbyo.files.cmp.optimizely.com/download/84764f7a85ba11ef87e9da1cab964337
    Copy of drive (data integrity and preservation)
    Checked 2026-10-11.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich Windows feature encrypts an entire drive volume to protect data on lost or stolen devices?Security & PrivacyWhich feature encrypts removable drives such as USB flash drives in Windows?Security & PrivacyWhich Windows feature encrypts individual files and folders on NTFS volumes?

That's stuff everyone should know.