EC-Council 112-57 Exam - Topic 1 Question 17 Discussion

The role described---being responsible for evidence gathered at the crime scene and maintaining a record that makes the evidence admissible in court---matches the duties of an Evidence manager. In digital forensics practice, admissibility depends heavily on proving integrity, authenticity, and continuity of possession. The evidence manager ensures these requirements by implementing and documenting the chain of custody, which is the formal, chronological record of who collected the evidence, when and where it was collected, how it was packaged and labeled, how it was transported, where it was stored, and every time it was accessed or transferred. This role also enforces evidence handling procedures such as tamper-evident sealing, secure storage controls, access logging, and verification steps (for example, ensuring hashes are recorded and preserved for forensic images).

An incident responder focuses on containment and immediate actions during an incident; an incident analyzer performs technical analysis and correlation of artifacts; and an evidence examiner conducts detailed forensic examinations on acquired data. While these roles interact with evidence, the specific responsibility for maintaining custody documentation and evidence records to support legal admissibility belongs to the Evidence manager, making D the correct answer.