Examkin

Question

Difficulty: HardDigital Forensics and Chain of Custody

A forensic investigator arrives at an enterprise branch office to analyze a powered-on physical server suspected of hosting an active in-memory keylogger that exfiltrates proprietary records. To preserve evidence for legal proceedings while strictly following forensic acquisition standards, which of the following actions must the investigator take before acquiring non-volatile disk media?

  1. Capture the host system memory (RAM) to an external sanitized storage media and document the acquisition hash on the chain of custody form.Answer
  2. B
    Immediately disconnect the physical power cord from the server PSU to prevent memory content alterations by the malware.
  3. C
    Connect a hardware write-blocker to the primary storage drive and perform a full bit-stream disk image acquisition.
  4. D
    Export network socket logs from the edge firewall and sign the log digest with the investigator's private key to guarantee data integrity.

Answer

Capturing host system memory (RAM) to sanitized storage and logging its cryptographic acquisition hash on the chain of custody form prior to non-volatile disk acquisition.
The correct action prioritizes system RAM preservation over non-volatile media in strict accordance with the Order of Volatility (CPU registers/cache → System RAM → Swap/page files → Hard disk drive → Archival media). Furthermore, recording the acquisition hash on a formal chain of custody document ensures tamper-evidence and legal admissibility.

Step-by-Step Solution

1
Evaluate the current state of the compromised host.
The server is powered on and running an active in-memory malware threat.
Live systems contain highly volatile data in CPU cache and RAM that will be permanently lost if powered down or if lower-volatility acquisitions are prioritized.
2
Apply the Order of Volatility principles.
RAM must be acquired before non-volatile media (hard drives/SSDs).
Data in RAM changes rapidly and cannot be recovered once overwritten or cleared.
3
Establish Chain of Custody and Evidence Integrity.
Calculate a cryptographic hash (e.g., SHA-256) of the memory dump immediately upon acquisition and log it alongside timestamp and handler details.
Proves evidence integrity and authenticates the acquisition state for court admissibility.

Key Concept

Order of Volatility and Chain of Custody Integrity
Estimated Time:2m 0s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic