An IT technician responds to a security incident involving a workstation at a customer service desk where a hardware keylogger was discovered attached to a rear USB port. The technician takes photographs of the device setup in place and isolates the computer from the network to preserve evidence. According to standard incident response and chain-of-custody protocols, which of the following actions should the technician perform NEXT before transferring the hardware keylogger to the forensic analyst?
- Document the date, time, physical location, and handler signature on a chain-of-custody log before securing the keylogger in an anti-static evidence bag.Answer
- BPlug the hardware keylogger into a secure forensic workstation to inspect its stored log files and assess stolen credentials.
- CImmediately perform a hard power shutdown of the workstation by holding down the power button to prevent further keylogging.
- DHand the hardware keylogger directly to facility security personnel without recording any evidence transfer forms.
Answer
Documenting the date, time, physical location, and handler signature on a chain-of-custody log before securing the keylogger in an anti-static evidence bag maintains an unbroken chain of evidence custody.
Chain of custody requires meticulous recordkeeping for all physical and digital evidence collected during an incident. Before moving or transferring an evidence item, first responders must log the timestamp, location, item description, and handler credentials onto an official tracking form to prevent claims of tampering.
Step-by-Step Solution
Key Concept
Chain of Custody Documentation and Evidence Preservation