Examkin

Question

Difficulty: EasyDigital Forensics and Chain of Custody

A security analyst captures an image of a hard drive from a compromised workstation during an active incident. Which of the following should the analyst perform immediately after acquiring the disk image to prove that the evidence remains unaltered?

  1. Calculate and record a cryptographic hash of the original drive and the created image.Answer
  2. B
    Reboot the workstation into safe mode to verify that the forensic image boots successfully.
  3. C
    Encrypt the hard drive using the organization's public key to establish non-repudiation.
  4. D
    Store the acquired disk image directly on a network share accessible by the incident response team.

Answer

Calculating and recording cryptographic hashes of both the original media and the disk image establishes evidence integrity.
Computing cryptographic hash values immediately after drive acquisition generates a unique mathematical fingerprint of the source and target image. Matching hashes demonstrate that the forensic copy is bit-for-bit identical to the source and has not been altered.

Step-by-Step Solution

1
Identify the primary requirement for maintaining evidence integrity in digital forensics.
Digital evidence must be verifiable as an exact, uncorrupted replica of the source data.
Forensic proof in legal proceedings requires demonstrating that evidence was not modified during or after acquisition.
2
Select the cryptographic mechanism used to verify file and disk image integrity.
Cryptographic hashing algorithms (e.g., SHA-256) create unique fixed-length digests of data.
Matching hash values between the source drive and forensic copy confirm identical data content without altering the evidence.

Key Concept

Cryptographic Hashing for Evidence Integrity
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic