What is evidence preservation immediately after an incident?

• A. Document witnesses and preserve digital logs only.
• B. Notify security only, no documentation.
• C. Move the scene to a different location to avoid disruption.
• D. Secure the scene, minimize disturbance, document witnesses, and preserve physical evidence.

Answer: (D)

Immediately after an incident, the priority is to keep evidence intact while creating a clear record of what happened. The best approach is to secure the scene, minimize disturbance, document witnesses, and preserve physical and digital evidence. Securing the scene prevents contamination or unintended changes; minimizing disturbance helps maintain the original state of items and conditions; documenting witnesses captures who saw what and when, which supports reconstruction and timeline accuracy; and preserving physical evidence ensures tangible items remain available for analysis, while also maintaining a proper chain of custody for later investigations. The other options fall short because they either skip securing the scene or documentation, rely on moving or altering the scene, or focus on only one aspect (like digital logs) without protecting the broader evidentiary integrity.