Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

During an insider threat investigation, a security analyst physically disconnects a target workstation's secondary storage drive to perform forensic acquisition. Before connecting the drive to the analysis workstation to capture a bit-stream image, which of the following steps should the analyst take to prevent accidental modification of metadata or timestamps?

  1. Attach the target drive to a hardware write-blocker prior to connecting it to the forensic workstation.Cevap
  2. B
    Mount the target drive directly using the analysis workstation's native operating system set to read-only mode.
  3. C
    Encrypt the drive using an asymmetric private key to establish non-repudiation before creating the image.
  4. D
    Generate a SHA-256 hash of the live drive while it is connected directly to the target system prior to drive removal.

Cevap

Attaching the target drive to a hardware write-blocker prior to connecting it to the forensic workstation is the essential first step to preserve evidence integrity.
Connecting the storage device through a dedicated hardware write-blocker ensures that all write requests issued by the forensic station's operating system are physically intercepted and blocked. This prevents any alteration of access times, file metadata, or sector data, maintaining the cryptographic integrity of the original media.

Adım Adım Çözüm

1
Identify the risk of connecting raw storage media to an analysis workstation.
Recognize that standard operating systems automatically modify disk volume metadata, journal logs, and access timestamps upon mounting.
Host OS automatic background writes taint digital evidence unless explicitly blocked.
2
Select the appropriate forensic control to block hardware write operations.
Utilize a hardware write-blocker between the suspect storage drive and the forensic analysis station.
Hardware write-blockers intercept read-write signaling at the controller interface, guaranteeing read-only access regardless of host OS behavior.
3
Proceed with forensic acquisition and verification.
Generate bit-stream disk images and compute verification hash values safely without altering original evidence.
Ensures forensic admissibility in legal and regulatory proceedings.

Anahtar Kavram

Forensic Write-Blocking and Evidence Preservation
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru