Examkin

Soru

Zorluk: OrtaIncident Response and Chain of Custody

An enterprise IT technician arrives at a scene where a running server is suspected of being compromised during an active data exfiltration incident. Arrange the technician's digital evidence preservation steps in the correct sequence according to standard forensic order of volatility and incident response procedures.

  1. 1Capture system RAM and volatile memory contents to secure external storage.
  2. 2Record active network connections, running system processes, and temporary swap files.
  3. 3Create a bit-stream forensic image of the secondary storage drives using a hardware write-blocker.
  4. 4Complete the chain of custody form with exact date, time, serial numbers, and evidence collector signature.

Cevap

The correct sequence follows the order of volatility: capture system RAM first, record active network and process states second, create a bit-stream image of non-volatile storage drives third, and complete the chain of custody log fourth.
Digital evidence preservation strictly follows the order of volatility to prevent evidence degradation. The sequence starts with capturing system RAM (highest volatility), followed by recording active processes and network connections, then imaging non-volatile hard drives using a hardware write-blocker, and concluding with completing the chain of custody form to ensure legal defensibility.

Adım Adım Çözüm

1
Preserve the most volatile evidence first.
System RAM and live memory contents are captured to write-protected external storage.
RAM contents are easily altered or destroyed by power loss or routine system operations.
2
Collect active system state information.
Network connections, open ports, and active process tables are logged.
These states change rapidly as network traffic flows and processes terminate.
3
Perform bit-stream imaging of persistent storage.
Secondary storage drives are imaged using a hardware write-blocker.
Non-volatile storage retains data permanently without power and can be safely imaged after volatile data is secured.
4
Finalize legal evidence tracking documentation.
The chain of custody log is filled out with timestamps, identifiers, and handler signatures.
Detailed documentation maintains evidence integrity and admissibility in legal proceedings.

Anahtar Kavram

Order of Volatility and Incident Response Evidence Preservation
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru