ノースカロライナ州シャーロットの投資銀行で発生した長期にわたる横領事件の捜査において、押収された帳簿や保管機器は、受付担当者、鑑識官、監査人など、複数の担当者を経由して移動した。証言中に証拠改ざんの疑いが生じた場合に備え、それぞれの移動を記録しておく必要がある。この継続的な取り扱いと移動の記録を確立する文書要素はどれか?
正解:C
The correct answer is C because this describes chain of custody documentation, whose purpose is to record the movement and handling of evidence from the moment it is collected through transfer, storage, examination, and presentation. CHFI v11 explicitly includes chain of custody, preserving evidence, and best practices for handling digital evidence. In a case involving multiple custodians, the essential need is not just to list who was involved, but to maintain a continuous documented history showing where the evidence went, who possessed it, when transfers occurred, and under what conditions. That continuous record is what allows an examiner to rebut claims that the evidence was altered, substituted, or tampered with. Option A captures part of that idea but is incomplete because it does not emphasize the end-to-end movement of the evidence.
Option B describes procedures, and option D describes initial collection details, but neither establishes the full transfer history. For CHFI exam purposes, the key documentation element that proves continuity of possession is the record documenting the movement of evidence from origin through examination.