Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

An incident response analyst seizes a powered-on smartphone that is suspected of being used in an active data exfiltration incident. To prevent remote wipe commands or external data modification over cellular or Wi-Fi networks while transporting the physical evidence to the forensics laboratory, which of the following is the most appropriate action to take?

  1. Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.Cevap
  2. B
    Unlock the device screen and manually enable Airplane Mode before transport.
  3. C
    Initiate an immediate remote cloud backup using suspect credentials prior to power-off.
  4. D
    Re-encrypt the internal flash controller with a temporary public key to ensure non-repudiation during transport.

Cevap

Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.
Enclosing the mobile device in a Faraday bag creates a Faraday cage that blocks all incoming and outgoing radio frequency (RF) signals, such as cellular, Wi-Fi, and Bluetooth. This prevents attackers from issuing remote wipe commands or altering data over the network while the investigator transports the device for evidence collection.

Adım Adım Çözüm

1
Identify the threat vector facing mobile device evidence during transit.
Powered-on mobile devices remain connected to cellular, Wi-Fi, or Bluetooth networks and are vulnerable to remote wipe commands or automated data syncs.
Over-the-air signals can modify or destroy evidentiary data before forensic acquisition.
2
Evaluate evidence preservation controls against forensic standards.
Using a Faraday enclosure blocks all electromagnetic radio frequency signals without altering the device's volatile RAM state or system logs.
Radio frequency isolation guarantees physical evidence preservation without user interface interaction.

Anahtar Kavram

Radio Frequency (RF) Signal Isolation in Digital Forensics
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru