How should evidence be preserved during an investigation?

• A. Document timestamps and preserve physical evidence.
• B. Destroy outdated records after a set period.
• C. Alter timestamps to protect privacy.
• D. Avoid altering or destroying evidence, document timestamps, preserve physical evidence, secure digital records, and maintain chain-of-custody.

Answer: (D)

Preserving evidence during an investigation means keeping it intact, traceable, and available for review from collection through to resolution. The best approach includes not altering or destroying anything, documenting timestamps, preserving physical items, securing digital records, and maintaining a clear chain of custody so everyone knows who handled the evidence and when. This combination protects the integrity of the evidence, supports accurate findings, and helps ensure the investigation is credible and admissible if any legal or administrative actions follow.

Only focusing on timestamps and physical items misses important aspects like digital evidence, ongoing custody, and the need to avoid any changes that could affect reliability. Destroying records after a set period conflicts with preservation goals, and altering timestamps to shield privacy would compromise integrity and trust in the process.