Which action is not part of preserving evidence during an incident response?

• A. Secure the scene
• B. Maintain chain of custody
• C. Label, photograph, collect and store items in evidence locker
• D. Disposing of evidence immediately after collection

Answer: (D)

Preserving evidence during an incident response means keeping evidence intact and admissible by securing the scene, tracking everyone who handles it, and properly documenting and storing it. Securing the scene prevents tampering and contamination, and maintaining a clear record of who handles each item ensures the evidence remains trustworthy. Labeling, photographing, collecting, and storing items in an evidence locker provide the necessary identification, context, and protection so the evidence can be analyzed later or presented in court. Disposing of evidence immediately after collection would destroy potential proof and break the needed trail of custody, which is why it does not fit with preservation.