A security analyst is investigating a compromised cloud-hosted Linux virtual machine suspected of participating in an ongoing data exfiltration attack. To ensure proper digital forensics and maintain legal defensibility, which of the following actions should the analyst perform during initial evidence acquisition? (Select TWO).
- Capture a dump of system memory (RAM) prior to modifying storage states or powering off the virtual machineAnswer
- Calculate cryptographic hash values for captured forensic images immediately after acquisition and log them in the custody recordAnswer
- CPower off the virtual server immediately to freeze disk states before capturing volatile artifacts
- DRely solely on digital signatures to guarantee data integrity without recording SHA-256 hash digests on evidence intake logs
Answer
The correct procedures are to capture a dump of system memory (RAM) prior to modifying storage states or powering off the virtual machine, and to calculate cryptographic hash values for captured forensic images immediately after acquisition and log them in the custody record.
Adhering to the Order of Volatility dictates that volatile RAM must be dumped before system shutdown or storage modifications. Additionally, calculating cryptographic hashes immediately after evidence acquisition and recording them in the chain of custody log proves that evidence integrity was preserved throughout handling.
Step-by-Step Solution
Key Concept
Order of Volatility and Evidence Integrity Logging
Estimated Time:1m 30s