Examkin

Question

Difficulty: HardDigital Forensics and Chain of Custody

A digital forensics analyst receives a seized external hard drive transported from a field office via a secure courier. Upon intake, the analyst notices that the tamper-evident transport bag was torn and the accompanying paper tracking form lacks the courier's transfer signature. Before connecting the drive to a hardware write-blocker for imaging, which of the following actions MUST the analyst perform first to maintain evidentiary standards?

  1. Document the seal discrepancy and missing signature on the chain of custody log, notify the lead investigator, and recalculate the intake verification hash.Answer
  2. B
    Overwrite the initial field intake hash record with a newly computed hash value to ensure the original evidence log matches the received hardware state.
  3. C
    Generate a asymmetric public key digital signature for the physical drive to establish non-repudiation of the transport courier's identity.
  4. D
    Connect the physical drive directly to an online workstation without a write-blocker to inspect the file system metadata and confirm file modified dates.

Answer

Document the seal discrepancy and missing signature on the chain of custody log, notify the lead investigator, and recalculate the intake verification hash.
Chain of custody protocol dictates that any physical damage, missing signatures, or transfer anomalies must be explicitly recorded in the evidence tracking log. Logging the discrepancy immediately alongside re-verifying hash values ensures full transparency and legal defensibility when presenting evidence in court.

Step-by-Step Solution

1
Inspect the physical evidence packaging and custody documentation upon receipt.
Identified physical seal damage and missing transfer signatures on the tracking document.
Chain of custody requires continuous accounting of evidence handling, physical security, and custodian transfers.
2
Log all observed irregularities directly on the formal custody documentation and inform incident leadership.
Maintained an accurate, audit-ready record of potential transit compromise without concealing handling defects.
Failing to document physical tampering creates unexplainable gaps that invalidate evidence admissibility in legal proceedings.
3
Verify drive integrity against baseline cryptographic hash values logged prior to transit.
Determined whether data content was altered during transport.
Comparing hash values verifies data integrity despite physical package damage.

Key Concept

Chain of Custody Documentation and Evidence Intake Integrity Verification
Estimated Time:2m 0s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic