Examkin

Soru

Zorluk: Çok zorDigital Forensics and Chain of Custody

During a complex security incident investigation involving an enterprise storage array hosting virtualized database servers, a forensic investigator must extract and preserve digital evidence for upcoming judicial proceedings. The storage array utilizes volatile write caches mirrored asynchronously across active controller nodes. To preserve evidence integrity and establish an unassailable chain of custody during acquisition, which of the following procedures should the investigator perform first?

  1. Capture the live volatile memory from the active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and log the hashes, timestamps, and hardware serial numbers on the chain of custody form.Cevap
  2. B
    Immediately disconnect physical power to all storage array nodes to halt active caching, extract the NVMe drives, and connect them directly to an investigation system without a write-blocker to compute baseline hashes.
  3. C
    Export virtual machine disk files over the network to an administrative repository, applying a public key infrastructure digital signature to verify the non-repudiation of the cloud administrator's user account.
  4. D
    Run an automated file system defragmentation and metadata consolidation pass on the host volume prior to creating a bit-stream image using native host operating system utilities.

Cevap

The investigator must first capture the live volatile memory from active host and controller write caches, compute cryptographic SHA-256 hashes immediately upon acquisition, and record the hashes, timestamps, and hardware serial numbers on the chain of custody log.
Digital forensics requires capturing evidence in strict compliance with the order of volatility: volatile system RAM and controller write caches must be preserved before persistent storage acquisition or host shutdown. Calculating cryptographic SHA-256 hashes immediately upon collection and documenting timestamps, serial numbers, and examiner details on a chain of custody log guarantees evidence integrity and court admissibility.

Adım Adım Çözüm

1
Prioritize evidence collection according to the Order of Volatility.
Live volatile host memory (RAM) and asynchronous controller write caches are identified as the most perishable evidence sources.
Terminating power or taking disks offline destroys unwritten volatile cache and RAM contents permanently.
2
Capture volatile data and calculate immediate baseline cryptographic hashes.
A forensic memory acquisition is completed and SHA-256 hashes are calculated immediately.
Calculating a cryptographic hash at the exact time of acquisition provides mathematical proof that evidence has not been altered.
3
Execute formal chain of custody logging.
Item descriptions, hardware serial numbers, collection timestamps, hash values, and custodial details are documented.
Maintaining an unbroken chain of custody log establishes legal traceability and admissibility in court.

Anahtar Kavram

Order of Volatility & Chain of Custody Evidence Logging
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru