A company's incident response team has completed the initial containment of a compromised database administrator workstation. An IT specialist is tasked with transporting the internal solid-state drive, which has been placed in a sealed evidence bag, to an off-site forensic laboratory. Which of the following actions must the specialist perform at the exact moment the drive is handed over to the laboratory analyst to maintain an unbroken chain of custody?
- Have the receiving analyst inspect the tamper-evident seal, sign the custody log, and record the precise date and time of the physical transfer.Cevap
- BAttach the drive to a forensic workstation via a hardware write-blocker to confirm file integrity before completing the handoff log.
- CUpdate the central helpdesk ticketing workflow system with the laboratory work order number prior to relinquishing physical possession.
- DRe-evaluate the malware attack vectors and threat classifications documented during initial containment to re-tag the physical evidence bag.
Cevap
Have the receiving analyst inspect the tamper-evident seal, sign the custody log, and record the precise date and time of the physical transfer.
Chain of custody protocols dictate that whenever physical evidence moves from one handler to another, both parties must record the exact date and time, verify that the evidence seal is intact, and sign the custody log. This guarantees chronological accountability and evidence integrity for forensic analysis and legal proceedings.
Adım Adım Çözüm
Anahtar Kavram
Chain of custody maintenance and physical evidence documentation protocols