Security operations analysts respond to an active incident involving a compromised Linux database server running on an enterprise hypervisor. Network telemetry reveals memory-injected malware executing encrypted outbound command-and-control communication. The evidence gathered must be admissible in court for potential legal prosecution. Which of the following actions MUST the forensics team take to adhere strictly to the order of volatility and maintain chain of custody integrity? (Select TWO.)
- Capture the system RAM and volatile state artifacts over a dedicated isolated interface before initiating any system power state change or virtual machine shutdown.Cevap
- Calculate independent cryptographic hashes of the forensic images immediately post-acquisition and document every transfer and access event on a formal custodial tracking form.Cevap
- CPerform a hypervisor-level virtual machine snapshot and immediately force-power-down the guest instance to prevent memory corruption before running memory dump utilities.
- DGenerate a SHA-256 checksum of the forensic acquisition log to provide non-repudiation of the investigating analyst's individual identity during evidence seizure.
Cevap
The incident response team must acquire system RAM before any power state changes to honor the order of volatility, and must generate immediate post-acquisition cryptographic hashes coupled with formal chain of custody logging to ensure legal integrity and admissibility.
Capturing live system RAM prior to system shutdown preserves the most volatile evidence, adhering to the order of volatility. Simultaneously, establishing post-acquisition cryptographic hashes and maintaining explicit custodial logs guarantees evidence integrity and legal chain of custody.
Adım Adım Çözüm
Anahtar Kavram
Forensic Order of Volatility and Chain of Custody Verification