Examkin

Soru

Zorluk: OrtaIncident Response and Chain of Custody

A systems administrator is preparing to transfer a physical solid-state drive containing critical digital evidence to an external forensic investigator. Which of the following actions must be taken during the physical handover to maintain a legally valid chain of custody?

  1. Record the date, time, and signatures of both the releasing and receiving individuals on the custody log.Cevap
  2. B
    Mount the storage drive on a workstation to document a directory list of all stored files before handing it over.
  3. C
    Perform a bit-by-bit wipe of unallocated drive space to protect sensitive corporate data during transit.
  4. D
    Attach the drive's BitLocker recovery password directly onto the tamper-evident storage bag.

Cevap

Record the date, time, and signatures of both the releasing and receiving individuals on the custody log.
A chain of custody log tracks evidence from collection through final disposition. During a physical transfer, logging the exact date, time, and signatures of both the releasing and receiving personnel ensures complete accountability and legal chain-of-custody compliance.

Adım Adım Çözüm

1
Identify the primary requirement for maintaining evidence integrity during physical transfer.
Chain of custody requires continuous trackability of who possessed the evidence at any given time.
Without verified transfer logs, evidence can be challenged for tampering or unauthorized access in legal proceedings.
2
Evaluate required fields on a standard chain of custody log.
Every transfer point requires exact timestamps, recipient identification, and relinquisher signatures.
This establishes an unbroken chronological paper trail showing proper custody and accountability.

Anahtar Kavram

Chain of Custody Documentation in Digital Forensics
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru