Examkin

Soru

Zorluk: Çok zorIncident Response and Chain of Custody

During an incident investigation regarding unauthorized data access on an executive laptop, a technician takes the following sequential steps to secure the hardware for digital forensics:
1. Disconnects the laptop from the wireless network by toggling airplane mode.
2. Captures an image of the system's volatile memory (RAM) to a sanitized external drive.
3. Performs a graceful system shutdown using the operating system interface.
4. Fills out a chain of custody form with the laptop's serial number, exact time, date, and current location.
5. Transports the laptop to the forensic laboratory after hours and places it on the forensic analyst's desk without securing a recipient signature.

Which of the following actions performed by the technician represents the most critical violation of evidence handling protocols?

  1. Leaving the laptop on the analyst's desk without securing a verified recipient signature on the chain of custody log.Cevap
  2. B
    Executing a graceful system shutdown through the operating system rather than disconnecting the power source immediately.
  3. C
    Toggling airplane mode to disconnect from wireless network access rather than placing the laptop in a Faraday bag.
  4. D
    Capturing the volatile memory (RAM) prior to creating a forensic image of the internal storage drive.

Cevap

Leaving the laptop on the analyst's desk without securing a verified recipient signature on the chain of custody log is the most critical violation because it creates an unmonitored gap in evidence possession.
The chain of custody log must contain an unbroken chronological history of every individual who collected, transferred, analyzed, or secured the evidence. Leaving evidence on a desk overnight creates an unmonitored period where unauthorized individuals could tamper with or swap the laptop, invalidating the evidence for legal proceedings.

Adım Adım Çözüm

1
Analyze the technician's actions against the Order of Volatility.
Capturing RAM before non-volatile disk storage correctly follows the order of volatility (RAM is lost upon power loss).
Volatile memory must be gathered before system shutdown.
2
Analyze network isolation steps.
Disabling wireless via airplane mode successfully isolates the host from remote commands, even if physical RF shielding is preferred.
Network isolation prevents active data exfiltration or remote wiping.
3
Evaluate evidence transfer and Chain of Custody requirements.
Leaving evidence on an unmonitored desk breaks the documented chain of custody because custody is lost and accountability cannot be verified.
Every transfer of physical or digital evidence requires contemporaneous signatures, dates, timestamps, and recipient verification.

Anahtar Kavram

Maintaining an Unbroken Chain of Custody
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru