Examkin

Soru

Zorluk: ZorIncident Response and Chain of Custody

A field technician is called to secure a finance manager's workstation that was infected with ransomware via a suspicious email link. The technician immediately isolates the workstation from the corporate network and captures a forensic image of volatile memory. To ensure all evidence remains legally admissible, the technician prepares to transfer the physical workstation to the enterprise forensics team. Which of the following details MUST be documented on the chain of custody form during this transfer?

  1. The date, time, unique device serial numbers, and the signatures of both the transferring technician and receiving investigatorCevap
  2. B
    The domain administrator credentials and local disk encryption recovery keys for the compromised workstation
  3. C
    The physical bollard specifications and perimeter badge access logs for the facility building
  4. D
    The threat classification taxonomy and technical malware family vector assigned by the security analyst

Cevap

The date, time, unique device serial numbers, and the signatures of both the transferring technician and receiving investigator must be documented on the chain of custody form during the transfer.
Chain of custody documentation provides an unbroken chronological record tracking the acquisition, transfer, analysis, and disposition of physical and digital evidence. Whenever evidence changes hands, the log must capture the date, time, exact item description and serial number, location, and the verified signatures of both the individual surrendering the evidence and the individual receiving it.

Adım Adım Çözüm

1
Identify the core purpose of chain of custody documentation in forensic procedures.
Chain of custody establishes a continuous, legally defensible audit trail showing who possessed, secured, or transferred physical and digital evidence at every point in time.
If custody cannot be proven unbroken, evidence may be deemed tampered with or inadmissible in legal proceedings.
2
Identify mandatory fields required during an evidence custody transfer.
The log must record the precise date and time of transfer, detailed description and serial numbers of the item, location details, and the full names and signatures of both the releasing party and receiving party.
This establishes clear responsibility and accountability for the evidence at the exact moment of transfer.
3
Evaluate the choices against chain of custody logging standards.
Recording timestamps, hardware identifiers, and signatures of both parties satisfies the formal chain of custody requirements.
Passwords, building physical barrier specifications, and malware classification taxonomies do not fulfill evidence tracking requirements.

Anahtar Kavram

Chain of Custody Documentation Requirements
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru