An incident responder is dispatched to preserve evidence from a powered-on corporate database server involved in an ongoing security breach. To ensure evidence integrity and adhere to forensic best practices, which of the following actions should the responder take? (Select TWO.)
- Dump volatile system memory (RAM) before shutting down or powering down the system.Cevap
- Calculate cryptographic hashes of all acquired disk images immediately after creation and record them in the chain of custody log.Cevap
- CPower off the server immediately to prevent volatile data from being overwritten by operating system processes.
- DEncrypt the raw disk image using a public key to ensure non-repudiation of the evidence collector's identity.
Cevap
The incident responder must dump volatile system memory (RAM) before powering off the host, and calculate cryptographic hashes of all acquired images immediately after creation to record in the chain of custody log.
Capturing RAM first respects the order of volatility, ensuring transient data like active network connections and running memory artifacts are preserved. Calculating and logging cryptographic hashes immediately establishes baseline evidence integrity for legal chain of custody requirements.
Adım Adım Çözüm
Anahtar Kavram
Digital Forensics Evidence Preservation and Chain of Custody Verification