Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

A security analyst is conducting a digital forensics collection on a Linux server suspected of being compromised by an attacker. To adhere to forensic principles regarding the order of volatility and evidence integrity, which of the following procedures should the analyst perform during the acquisition phase? (Select TWO).

  1. Capture the contents of physical RAM prior to shutting down or rebooting the server.Answer
  2. Calculate and record SHA-256 cryptographic hashes of the disk images immediately following acquisition.Answer
  3. C
    Perform a soft reboot of the operating system to clear active network sockets before imaging storage media.
  4. D
    Encrypt the source drive using the target system's native BitLocker/LUKS tool before attaching a hardware write-blocker.

Answer

The analyst should capture the contents of physical RAM prior to shutting down or rebooting the server, and calculate and record SHA-256 cryptographic hashes of the disk images immediately following acquisition.
Preserving volatile RAM before system shutdown ensures transient artifacts are saved according to the order of volatility. Calculating cryptographic hashes immediately post-acquisition ensures the integrity of the evidence can be validated throughout the investigation.

Step-by-Step Solution

1
Evaluate the order of volatility for system components.
System RAM, active network connections, and cache are highly volatile and lost upon system shutdown or reboot, so RAM must be captured first while the system is running.
Capturing volatile memory before powering down preserves critical artifacts such as running processes, memory-resident malware, and decrypted keys.
2
Evaluate evidence integrity and chain of custody validation mechanisms.
Generating SHA-256 cryptographic hashes immediately post-acquisition creates an immutable mathematical fingerprint of the evidence.
Cryptographic hashes verify that forensic images remain exact byte-for-byte replicas of the evidence over time.

Key Concept

Order of Volatility and Evidence Integrity Preservation
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic