Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

A security analyst is preparing to create a bit-stream disk image from a physical hard drive seized during an insider threat investigation. Before connecting the target drive to the forensic workstation for image capture, which of the following controls should the analyst implement FIRST to protect the integrity of the original evidence?

  1. Connect a physical hardware write-blocker between the seized drive and the acquisition workstationAnswer
  2. B
    Mount the physical drive directly into the acquisition host operating system to calculate the initial hash value
  3. C
    Encrypt the physical drive casing using an asymmetric digital signature key pair to guarantee non-repudiation
  4. D
    Execute a full DoD 5220.22-M sanitization pass on the source drive prior to initiating the image capture

Answer

The analyst should connect a physical hardware write-blocker between the seized drive and the acquisition workstation.
Connecting a physical hardware write-blocker ensures that all write requests issued by the workstation's operating system are intercepted and dropped before reaching the evidence drive. This guarantees that the original evidence remains completely unaltered during bit-stream image acquisition.

Step-by-Step Solution

1
Identify the primary threat to physical evidence integrity during forensic image acquisition.
Standard operating systems automatically mount drives and write metadata (such as volume flags or access timestamps) when a drive is attached.
Preventing any write commands from reaching the original source media is required to preserve evidence admissibility.
2
Select the appropriate forensic control designed to intercept host write signals.
A hardware write-blocker blocks write commands at the controller layer while allowing read commands necessary for imaging.
Hardware write-blockers guarantee read-only access regardless of host OS behavior.
3
Begin bit-stream forensic imaging and hash generation after write-blocking is confirmed.
A true bit-by-bit copy is produced with matching source and target cryptographic hashes.
Establishes a verifiable chain of custody and maintains evidence integrity.

Key Concept

Use of Hardware Write-Blockers for Forensic Acquisition Integrity
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic