A forensic investigator must follow the chain of custody when handling digital evidence.

Chain of custody ensures evidence integrityby:

Documenting every stepin handling and transferring evidence.

Ensuring evidence remains unalteredand admissible in court.

Using forensic hashing methods(MD5, SHA-256) to verify integrity.

References:McAfee Institute CCII Digital Evidence Guide, Cyber Forensics Up and Running​.