Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

A digital forensics specialist receives a sealed evidence bag containing a seized hard drive from a field investigator for intake into the forensic laboratory. Which of the following actions should the specialist perform first to maintain the chain of custody?

  1. Inspect the tamper-evident container, verify the serial numbers against the transfer documentation, and sign the custody log.Cevap
  2. B
    Connect the drive directly to an analysis workstation to verify the file system structure before logging receipt.
  3. C
    Generate a cryptographic hash of the drive contents to establish non-repudiation of the field investigator's identity.
  4. D
    Create a bit-stream disk image directly onto the original evidence drive to preserve the master boot record.

Cevap

The specialist should inspect the tamper-evident container, verify serial numbers against transfer documentation, and sign the custody log.
Maintaining proper chain of custody requires documenting every physical transfer of evidence immediately upon receipt. Verifying tamper-evident seals and matching serial numbers against custody forms before signing ensures uninterrupted accountability and legal admissibility.

Adım Adım Çözüm

1
Examine physical evidence packaging upon receipt
Assures the evidence bag and tamper seals have remained intact since seizure.
Physical integrity of packaging proves evidence was not altered in transit.
2
Reconcile item identification numbers with the chain of custody form
Confirms the exact physical evidence handed over matches official records.
Mismatched serial numbers undermine legal admissibility in court.
3
Record timestamp, relinquishing party, receiving party, and signature on the custody log
Establishes unbroken accountability for physical possession.
Chain of custody requires an uninterrupted chronological record of custody.

Anahtar Kavram

Chain of Custody Intake and Evidence Handling
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru