Examkin

Soru

Zorluk: KolayIncident Response and Chain of Custody

An IT technician secures a compromised storage drive involved in an internal investigation and hand-delivers it to a forensics specialist. Which of the following details must be recorded on the chain of custody form during this evidence transfer?

  1. The date, time, and signatures of both the technician releasing the drive and the specialist receiving itCevap
  2. B
    The list of malware definitions and antivirus scans performed on the drive prior to transport
  3. C
    The physical security barrier controls and facility access specifications installed at the site
  4. D
    The threat classification and social engineering attack vector assigned to the incident

Cevap

The date, time, and signatures of both the technician releasing the drive and the specialist receiving it
Chain of custody documentation tracks the secure handling of physical and digital evidence. Whenever evidence changes hands, the log must record the exact date, time, reason for transfer, and signatures of both the individual releasing the evidence and the person receiving it to maintain an unbroken log of possession.

Adım Adım Çözüm

1
Identify the purpose of chain of custody documentation
Recognize that chain of custody establishes a legal, verifiable record of evidence handling and possession.
Chain of custody logs guarantee evidence integrity by demonstrating who controlled the item at all times.
2
Determine the essential transfer record entries
Identify that timestamped transfer entries and handler identity signatures are required.
Every transfer of evidence requires recording the date, time, releasing party, and receiving party to prevent gaps in custody.

Anahtar Kavram

Chain of Custody Documentation
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru