Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

A digital forensic examiner receives a powered-off workstation hard drive confiscated during an insider threat investigation. The examiner needs to duplicate the physical drive onto a forensic storage unit for analysis while ensuring evidence admissibility in court. Which of the following actions should the examiner take FIRST?

  1. Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.Answer
  2. B
    Boot the workstation using its native operating system to verify that the file system is intact.
  3. C
    Encrypt the physical drive using a single symmetric key to establish non-repudiation.
  4. D
    Mount the target storage drive in read-write mode to expedite checksum calculations.

Answer

Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.
Attaching the drive to a hardware write-blocker prevents any write signals from reaching the source disk, guaranteeing that no file timestamps or data blocks are altered during the acquisition phase.

Step-by-Step Solution

1
Identify the primary requirement for disk-based evidence acquisition.
The target physical storage device must be protected against any write commands from the acquiring system.
Operating systems automatically write hidden system metadata, update access timestamps, or modify logs when storage drives are attached without hardware write protection.
2
Select the appropriate control for physical disk evidence protection.
Interpose a hardware write-blocker between the original suspect storage drive and the forensic analysis machine.
Hardware write-blockers intercept write commands at the controller layer, ensuring bit-for-bit acquisition without altering the source media.

Key Concept

Write-Blocker Utilization and Forensics Integrity
Estimated Time:1m 0s
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic