Question

A technician confiscated an employee's computer after management learned the employee had unauthorized material on his system. Later, a security expert captured a forensic image of the system disk. However, the security expert reported the computer was left unattended for several hours before he captured the image. What is a potential issue if this incident goes to court?

Answer 1

The unattended computer poses a legal issue regarding the chain of custody, possibly affecting evidence credibility and integrity in court.

Step-by-step explanation:

A potential issue if this incident goes to court is the argument over the chain of custody and whether the evidence (the forensic image of the system disk) has been tampered with or altered during the time the computer was left unattended. The defense could argue that the evidence is not credible due to the possibility of unauthorized access or changes made to the computer after it was confiscated but before the forensic image was captured. This could weaken the case for the prosecution, as it undermines the integrity of the evidence being presented against the employee.