Examkin

Soru

Zorluk: KolayDigital Forensics and Chain of Custody

An incident responder acquires a forensic bit-stream image of a compromised server's storage drive. To demonstrate in court that the collected evidence image remains untampered and identical to the original drive at the time of capture, which of the following actions should the responder perform?

  1. Calculate a cryptographic hash of the drive immediately upon acquisition and verify it against subsequent image copiesCevap
  2. B
    Re-acquire a live bit-stream image directly from the suspect server prior to each forensic analysis session
  3. C
    Encrypt the disk image using an asymmetric key pair to establish investigator identity non-repudiation
  4. D
    Maintain the physical storage drive in a powered-on state within a safe room to retain active system processes

Cevap

Calculating a cryptographic hash of the drive immediately upon acquisition and verifying it against subsequent image copies proves that the evidence remains unaltered.
Generating a cryptographic hash immediately upon evidence acquisition creates a unique checksum of the drive's contents. Comparing this original hash against the hash of working copies ensures that the evidence has remained untouched and authentic throughout the investigation.

Adım Adım Çözüm

1
Identify the requirement for proving digital evidence integrity in legal proceedings.
The requirement demands a deterministic mathematical method to prove data has not changed since collection.
Digital evidence can easily be altered accidentally or intentionally during handling.
2
Evaluate the mechanism used to verify file and disk image integrity.
Cryptographic hashing algorithms (such as SHA-256) generate a unique fixed-length string for the source drive.
If even a single bit of the evidence changes, the resulting hash value will change completely.
3
Match the best procedure to the scenario requirement.
Generating the hash immediately after acquisition and comparing future copies to this original hash verifies evidence integrity.
Matching hash values confirm data integrity and admissibility in legal settings.

Anahtar Kavram

Cryptographic Hashing for Evidence Integrity
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru