What is used to record the order in which evidence was handled, by whom, and the nature of the evidence handling?

The correct answer is related to the concept of the chain of custody. This term refers specifically to the process that tracks and documents the handling of evidence from the moment it is collected until it is presented in court or destroyed. Maintaining an accurate chain of custody ensures that the evidence remains admissible in legal proceedings by providing a clear record of what happened to the evidence, who interacted with it, and how it was maintained throughout the investigation. This is crucial for establishing the integrity and authenticity of the evidence.

In contrast to the chain of custody, an evidence log primarily serves as a detailed list of items collected but may not provide the comprehensive tracking of who handled each piece of evidence or the specific details of that handling over time. Security protocol refers to the broader set of guidelines and procedures for protecting organizational assets, and incident reports summarize the details of security incidents but do not specifically track evidence handling. Therefore, the chain of custody is the most appropriate term for documenting the handling process of evidence in a forensic context.