An IT technician discovers a corporate desktop actively communicating with a suspected command-and-control server. Which of the following represents the correct chronological sequence of steps the technician should take from initial containment through physical evidence handoff?
- 1Disconnect the Ethernet cable and disable wireless interfaces to isolate the workstation while keeping it powered on.
- 2Capture volatile system memory (RAM) and record active system connections.
- 3Shut down the workstation, remove the storage drive, calculate its cryptographic hash, and place it in a tamper-evident bag.
- 4Log the transfer timestamps and serial numbers on the chain of custody form and collect required signatures during physical handoff.
Answer
The correct order of incident response steps is: 1) Disconnect the Ethernet cable and disable wireless interfaces to isolate the workstation while keeping it powered on; 2) Capture volatile system memory (RAM) and record active system connections; 3) Shut down the workstation, remove the storage drive, calculate its cryptographic hash, and place it in a tamper-evident bag; 4) Log the transfer timestamps and serial numbers on the chain of custody form and collect required signatures during physical handoff.
Standard incident response mandates containing the threat first by isolating the system from the network while preserving power. Next, volatile evidence (RAM) is captured in accordance with the order of volatility. Once RAM is acquired, non-volatile evidence (the hard drive) is imaged, hashed, and sealed in a tamper-evident container. Finally, during physical transfer, the chain of custody log is populated with timestamps, device details, and signatures from both parties to maintain legal evidence integrity.
Step-by-Step Solution
Key Concept
Incident Handling Containment, Order of Volatility, and Chain of Custody Protocol