Which control supports forensic investigations by preserving evidence?

• A. Video surveillance
• B. Retention of video and logs for forensics
• C. Correlation of the video and card access data
• D. Electronic access control at ingress/egress

Answer: (B)

Preserving evidence for forensic investigations hinges on keeping retained, tamper-evident records of events. Retention of video footage and system logs creates a preserved, time-stamped trail investigators can examine even after data rotation or system changes. This supports chain of custody, data integrity (with protections like hash verifications), and the ability to provide data for legal or regulatory review. Without retention policies, surveillance video and access logs can be overwritten or discarded, reducing their usefulness. While video surveillance and the ability to correlate video with card access data and electronic access control provide important data sources, it is the explicit retention of video and logs that ensures the evidence is preserved and usable for forensic analysis.