Comprehensive and Detailed Explanation From Exact Extract:
Digital evidence gathering, as outlined in ISO/IEC 27037 and referenced in ISO/IEC 27035-2, must adhere to several core principles-reliability, sufficiency, relevance, and integrity. Relevance, in particular, means that the Digital Evidence First Responder (DEFR) must ensure that any item collected has direct or potential bearing on the investigation.
Relevance also requires:
Clear justification for why an item was acquired
Ability to trace the decision-making process
Alignment with investigation objectives
Option A misrepresents "sufficiency," which does not mean minimal collection but rather collecting enough evidence to support conclusions without overburdening the investigation. Option B contradicts the principle of reliability, which requires that processes be standardized and reproducible.
Reference:
ISO/IEC 27037:2012, Clause 6.2.2.4: "Relevance is determined by the value of the digital evidence in addressing the objectives of the investigation." ISO/IEC 27035-2:2016 references this standard in Clause 7.4.4 regarding forensic evidence handling.
Correct answer: C
-