Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

During an active incident response investigation involving an enterprise server suspected of executing malware in memory, a technician is instructed to power down the server immediately and pull the primary storage drive to generate a bit-stream disk image prior to capturing any system RAM or running processes. Which digital forensics principle is directly violated by executing this instruction?

  1. Order of volatilityAnswer
  2. B
    Chain of custody log tracking
  3. C
    Non-repudiation enforcement
  4. D
    Cryptographic hashing verification

Answer

Order of volatility
The correct answer identifies the order of volatility principle. Volatile data, such as system RAM, routing tables, and running processes, is permanently lost when a system is powered off or when non-volatile storage is prioritized over live memory collection. Therefore, investigators must always acquire the most volatile evidence first.

Step-by-Step Solution

1
Identify the forensic collection sequence described in the scenario
The technician is attempting to capture non-volatile disk storage before preserving volatile system RAM and running processes.
Forensic evidence collection must follow strict sequencing rules to avoid losing ephemeral evidence.
2
Apply the standard Order of Volatility principles
Volatile memory (CPU registers, cache, RAM) is lost upon shutdown, whereas disk drives preserve data across power cycles.
Preserving RAM before shutting down or acquiring disk images ensures critical active memory evidence is captured.

Key Concept

Order of Volatility
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic