An incident response analyst is tasked with preserving digital evidence from a compromised application server during an active incident. In what sequence should the analyst perform the following forensic acquisition and custody actions to adhere strictly to the Order of Volatility and evidence handling protocols?
- 1Capture contents of CPU registers and system RAM from the live machine.
- 2Dump temporary swap space and pagefiles from the storage controller.
- 3Acquire a bit-stream forensic image of the local hard disk using a hardware write-blocker.
- 4Calculate and record SHA-256 cryptographic hash values for all acquired forensic images.
- 5Complete the chain of custody log entry and secure physical evidence in tamper-evident packaging.
Cevap
The correct sequence begins with capturing the most volatile artifacts (CPU registers and RAM), followed by dump files/swap space, then imaging non-volatile local storage, calculating cryptographic SHA-256 hashes of the images, and finally documenting the chain of custody log and sealing evidence.
Forensic evidence acquisition follows RFC 3227 guidelines: preserve the most volatile data first (CPU registers and main RAM), followed by temporary virtual memory (swap/pagefiles), non-volatile local disk storage, calculating cryptographic checksums (SHA-256) to establish baseline integrity, and completing the chain of custody log and physical tamper-evident sealing last.
Adım Adım Çözüm
Anahtar Kavram
Order of Volatility and Chain of Custody Evidence Handling
Tahmini Süre:1m 30s