Which of the following incident response activities ensures evidence is properly handled?

Chain of custody is the documented chronological history of the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence. It ensures the integrity and admissibility of evidence in legal proceedings by proving that the evidence has not been tampered with or altered. E-discovery (electronic discovery) is the process of identifying, collecting, and producing electronically stored information (ESI) in response to a request for production in a lawsuit or investigation, but it doesn't specifically detail evidence handling. A legal hold (or litigation hold) is a process that an organization uses to preserve all forms of potentially relevant information when litigation is pending or anticipated, which is about preservation, not the handling process itself. Preservation is the act of keeping evidence intact, but chain of custody details how that preservation and handling are documented and maintained.