Examkin

Soru

Zorluk: ZorDigital Forensics and Chain of Custody

A forensic analyst is responding to a live incident on a Linux server suspected of executing an active data exfiltration script via open network sockets. The server is powered on and running in memory. To strictly adhere to the Order of Volatility while maintaining cryptographic chain of custody integrity, which of the following actions should the analyst perform first?

  1. Capture the contents of system RAM and active network connections using an established memory dump tool, immediately recording the SHA-256 hash in the evidence log.Cevap
  2. B
    Power down the server immediately to preserve running processes, then attach the storage drive to a hardware write-blocker for bit-stream imaging.
  3. C
    Perform a full bit-stream disk image of the primary storage drive before acquiring memory artifacts to prevent active malware from altering disk sectors.
  4. D
    Export active system logs to an external drive to establish non-repudiation of the attacker's actions, skipping memory capture to avoid modifying system state.

Cevap

Capture the contents of system RAM and active network connections using an established memory dump tool, immediately recording the SHA-256 hash in the evidence log.
Capturing system RAM and active network sockets first adheres strictly to the Order of Volatility, as volatile memory is erased upon system state changes or power loss. Calculating and recording a cryptographic SHA-256 hash immediately establishes data integrity and chain of custody accountability.

Adım Adım Çözüm

1
Assess the system state to determine the volatility of evidence.
System RAM, CPU registers, and active network connections are identified as transient evidence at risk of immediate destruction.
The forensic Order of Volatility dictates capturing evidence from highest volatility to lowest volatility.
2
Preserve volatile memory and network session state.
A memory dump image capturing RAM and active socket data is successfully generated from the live system.
Capturing memory prior to taking persistent disk images or powering off the host ensures volatile data is preserved.
3
Compute and document evidence hash values.
A SHA-256 cryptographic hash of the memory image is generated and written into the chain of custody documentation.
Logging the hash immediately establishes proof of integrity and guarantees the evidence remains untampered throughout the legal handling process.

Anahtar Kavram

Order of Volatility and Evidence Hash Verification
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru