An incident response team is conducting a digital forensics investigation on a compromised virtual database server hosting sensitive records. To ensure evidence admissibility in legal proceedings and maintain proper forensic procedure, the responders must handle volatile data and chain of custody documentation correctly. Which of the following procedures should the incident responders execute to meet these requirements? (Select TWO.)
- Capture volatile system memory (RAM) and active state prior to disconnecting storage volumes or powering down the machineAnswer
- BReboot the target virtual server into a read-only live OS environment before acquiring memory dumps to prevent third-party software contamination
- Calculate and record cryptographic hashes (such as SHA-256) of forensic image files immediately following acquisitionAnswer
- DSubstitute cryptographic hash logs for signed chain-of-custody transfer records to establish non-repudiation of investigator actions
Answer
Capturing volatile system memory (RAM) prior to disconnecting storage or shutting down, and calculating cryptographic hashes (such as SHA-256) immediately following image acquisition.
Capturing volatile memory before powering down complies with the order of volatility, ensuring ephemeral data such as active memory and network connections are captured. Computing cryptographic hashes immediately following acquisition establishes proof of data integrity for judicial admissibility.
Step-by-Step Solution
Key Concept
Order of Volatility and Digital Evidence Integrity
Estimated Time:2m 0s