Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

During an active incident response investigation involving an enterprise server suspected of executing malware in memory, a technician is instructed to power down the server immediately and pull the primary storage drive to generate a bit-stream disk image prior to capturing any system RAM or running processes. Which digital forensics principle is directly violated by executing this instruction?

  1. Order of volatilityCevap
  2. B
    Chain of custody log tracking
  3. C
    Non-repudiation enforcement
  4. D
    Cryptographic hashing verification

Cevap

Order of volatility
The correct answer identifies the order of volatility principle. Volatile data, such as system RAM, routing tables, and running processes, is permanently lost when a system is powered off or when non-volatile storage is prioritized over live memory collection. Therefore, investigators must always acquire the most volatile evidence first.

Adım Adım Çözüm

1
Identify the forensic collection sequence described in the scenario
The technician is attempting to capture non-volatile disk storage before preserving volatile system RAM and running processes.
Forensic evidence collection must follow strict sequencing rules to avoid losing ephemeral evidence.
2
Apply the standard Order of Volatility principles
Volatile memory (CPU registers, cache, RAM) is lost upon shutdown, whereas disk drives preserve data across power cycles.
Preserving RAM before shutting down or acquiring disk images ensures critical active memory evidence is captured.

Anahtar Kavram

Order of Volatility
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru