During an ongoing incident investigation involving an enterprise network gateway suspected of active data exfiltration, an incident responder is tasked with collecting digital evidence from the running target system to support potential legal prosecution. Which of the following procedures must the responder perform to maintain evidence integrity and adhere to forensic collection standards? (Select TWO.)
- Capture the system's volatile memory (RAM) prior to powering down the host or taking a disk image.Cevap
- BImmediately perform a force-shutdown on the host to freeze all disk state processes before memory extraction.
- Calculate and record SHA-256 cryptographic hashes of acquired disk images immediately after capture on the chain of custody form.Cevap
- DRely on the code-signing digital signatures of the host binaries to prove non-repudiation of the acquired evidence disk.
Cevap
The responder must capture the volatile RAM prior to host shutdown or disk imaging and calculate cryptographic hashes (SHA-256) immediately following image acquisition to log on the chain of custody documentation.
Adhering to forensic collection principles requires prioritizing memory collection according to the Order of Volatility (capturing RAM before volatile state is wiped) and establishing verifiable integrity controls (computing cryptographic hash values immediately upon image acquisition to record in the custody log).
Adım Adım Çözüm
Anahtar Kavram
Order of Volatility and Evidence Integrity Verification