This scenario aligns with CHFI v11 objectives under Standards and Best Practices Related to Computer Forensics , specifically the ENFSI Best Practices for the Forensic Examination of Digital Technology .
According to ENFSI guidelines, once evidence has been seized and secured, a structured laboratory assessment must be conducted before and during analysis. This phase focuses on evaluating exhibits, determining examination priorities, and maintaining detailed documentation of all items-whether analyzed immediately or deferred.
Maintaining records of both analyzed and non-analyzed exhibits is a key ENFSI requirement, as it ensures transparency, traceability, and accountability throughout the forensic process. CHFI v11 emphasizes that proper documentation allows investigators to track investigative progress, justify examination decisions, and demonstrate that no evidence was overlooked or mishandled. This practice also supports effective case management and preserves the integrity and admissibility of evidence in legal proceedings.
The other options describe different forensic phases: case evaluation occurs earlier at a strategic level, scene assessment applies to on-site evidence handling, and data acquisition refers specifically to extraction activities. In contrast, documenting and prioritizing exhibits in a controlled environment is a core function of the laboratory assessment , making option C the correct ENFSI-aligned answer.