In a prolonged embezzlement investigation at an investment bank in Charlotte, North Carolina, seized ledgers...

The correct answer is C because this describes chain of custody documentation, whose purpose is to record the movement and handling of evidence from the moment it is collected through transfer, storage, examination, and presentation. CHFI v11 explicitly includes chain of custody, preserving evidence, and best practices for handling digital evidence. In a case involving multiple custodians, the essential need is not just to list who was involved, but to maintain a continuous documented history showing where the evidence went, who possessed it, when transfers occurred, and under what conditions. That continuous record is what allows an examiner to rebut claims that the evidence was altered, substituted, or tampered with. Option A captures part of that idea but is incomplete because it does not emphasize the end-to-end movement of the evidence. Option B describes procedures, and option D describes initial collection details, but neither establishes the full transfer history. For CHFI exam purposes, the key documentation element that proves continuity of possession is the record documenting the movement of evidence from origin through examination.