What is the purpose of a tamper-evident chain of custody in a pentest?

• A. Publicly share all collected data.
• B. To accelerate the testing by skipping evidence handling.
• C. To ensure evidence is destroyed after the test.
• D. To prevent unauthorized alteration of evidence and document every action.

Answer: (D)

Preserving evidence integrity and accountability is the central purpose of a tamper-evident chain of custody in a pentest. It ensures that any artifacts collected during testing—logs, screenshots, files, or configuration snapshots—are protected against unauthorized changes and that every handling step is recorded. This means recording who collected the data, when and where it was stored, who accessed it, and what actions were performed, often using tamper-evident seals, cryptographic hashes, and signed audit trails. The result is trustworthy evidence that can be audited, defended, and reused for validation or client reporting, while enabling reproducibility of the assessment. It also helps protect confidentiality and compliance by controlling access to sensitive data. Choices that suggest sharing all data publicly, skipping evidence handling to speed up testing, or destroying evidence after the test miss the fundamental goal of maintaining traceability and integrity.