In incident response, who is responsible for collecting, preserving, and packaging electronic evidence?

• A. Local managers or other non-forensic staff
• B. Forensic laboratory staff
• C. Lawyers
• D. System administrators

Answer: (B)

Collecting, preserving, and packaging electronic evidence requires trained digital forensics personnel to ensure data integrity and proper chain of custody. Forensic laboratory staff have the expertise to perform the collection without altering data, use write blockers, create exact bit-for-bit images, verify integrity with hashes, and meticulously document who handled the evidence, when, and how it was stored. This discipline is essential for admissibility in court and to prevent contamination or loss of metadata. While incident responders may identify potential evidence and coordinate the response, and IT staff might assist with initial access or data gathering, the formal collection and packaging are best handled by forensic professionals or an accredited lab—in-house or external—to meet proper standards. Lawyers focus on legal aspects, not the hands-on handling of physical or digital evidence.