Examkin

Soru

Zorluk: KolayDigital Forensics and Chain of Custody

A digital forensics investigator takes possession of a storage drive seized during an internal security investigation. What is the primary purpose of completing a chain of custody document for this evidence?

  1. To maintain a continuous, chronological record of every person who collected, handled, transferred, and stored the evidenceCevap
  2. B
    To establish non-repudiation by encrypting the physical drive using asymmetric key pairs
  3. C
    To preserve volatile system memory (RAM) before shutting down the source computer
  4. D
    To continuously recalculate cryptographic hashes on the active operating system partition

Cevap

To maintain a continuous, chronological record of every person who collected, handled, transferred, and stored the evidence
The primary objective of maintaining a chain of custody document is to create an unbroken, verifiable log showing who collected, received, secured, and transferred evidence. This documentation proves that evidence was safeguarded against contamination or unauthorized access, satisfying legal requirements for court admissibility.

Adım Adım Çözüm

1
Identify the primary purpose of chain of custody in digital forensics
Chain of custody ensures legal defensibility by tracking evidence custody and preventing allegations of tampering.
Courtroom evidence admissibility requires proof of who collected, accessed, and secured the evidence at all times.
2
Evaluate the option choices against forensics definitions
The option stating that chain of custody maintains a continuous, chronological record of handling matches standard forensic evidence procedures.
Other options confuse chain of custody with cryptographic controls (digital signatures, hashing) or live data collection procedures (order of volatility).

Anahtar Kavram

Chain of Custody Documentation
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru