Examkin

Question

Difficulty: HardDigital Forensics and Chain of Custody

A forensic analyst receives a bit-stream disk image of a compromised virtual domain controller from an external incident response team. Prior to initiating analysis, the analyst calculates a SHA-256 hash of the evidence file and discovers that it does not match the SHA-256 hash value documented on the accompanying chain of custody form. Which of the following describes the most appropriate immediate course of action for the analyst to take?

  1. Document the hash discrepancy on the chain of custody log and halt analysis on the copy until the integrity discrepancy is investigated, as the evidence is legally inadmissible in its current state.Answer
  2. B
    Re-acquire a live memory dump from the powered-on hypervisor host before making any further modifications to the disk image file.
  3. C
    Update the chain of custody form with the newly calculated hash value to re-establish administrative alignment prior to proceeding with evidence carving.
  4. D
    Generate a digital signature using the analyst's private key to append non-repudiation controls to the evidence container.

Answer

Document the hash discrepancy on the chain of custody log and halt analysis on the copy until the integrity discrepancy is investigated, as the evidence is legally inadmissible in its current state.
In digital forensics, a cryptographic hash (such as SHA-256) serves as a digital fingerprint verifying that an evidence copy remains an exact bit-stream duplicate of the original source. If the computed hash does not match the hash logged at acquisition, the integrity of the evidence has been compromised. The investigator must document the discrepancy in the chain of custody record and refrain from analyzing the corrupted copy until the baseline can be verified against master image copies.

Step-by-Step Solution

1
Verify cryptographic integrity baseline
Discovered SHA-256 hash mismatch between received disk image and chain of custody documentation.
Cryptographic hashes verify that forensic images are bit-for-bit identical to the acquired evidence.
2
Apply forensic evidence handling rules
Recognize potential evidence contamination, corruption, or improper transfer handling.
A hash mismatch proves the evidence file was altered after the baseline hash was recorded.
3
Execute chain of custody protocol
Log the discrepancy immediately and suspend analysis on the compromised file pending source verification.
Preserves forensic soundness and prevents downstream analysis of corrupted or invalid evidence.

Key Concept

Cryptographic Hash Verification and Chain of Custody Integrity
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic