Which risk is associated with performing evidence collection without proper safeguards?

• A. Cache files are created
• B. The system may crash
• C. Date/time stamps may be altered
• D. Data is automatically encrypted

Answer: (C)

Preserving the authenticity of evidence includes keeping its metadata intact. When evidence is collected without safeguards, the process can touch files in ways that change their timestamps. Date/time stamps reflect when a file was created, modified, or accessed, and these times are part of the evidentiary record used to establish the sequence of events. If safeguards aren’t in place, copying data, using certain tools, or even system activity can modify these timestamps, making it hard to trust the timeline or the origin of the evidence. That’s why the risk most associated with improper safeguards is that date/time stamps may be altered.

The other options are not the primary risk tied to lacking safeguards. Cache files appearing or a system crash can occur under various conditions and aren’t specific to evidence integrity. Automatic encryption would complicate access but isn’t a direct result of not applying safeguards during collection. The key concern here is maintaining the accuracy of timestamps and other metadata to preserve a reliable, defensible record.