A digital forensics analyst has completed the imaging of a seized storage volume from an enterprise database server involved in a security incident. The analyst is preparing to transfer the physical evidence to an external forensic laboratory for detailed examination. Which of the following actions must the analyst take to maintain a valid chain of custody during this transfer? (Select TWO.)
- Record cryptographic SHA-256 hashes of the acquired evidence alongside timestamped logs before initiating evidence transferCevap
- Document sign-off signatures of both transferor and recipient detailing the exact date, time, and purpose on the chain of custody logCevap
- CTransport physical evidence in unsealed, transparent storage bags to enable immediate visual inspection by receiving lab personnel
- DApply a digital certificate signature to the physical drive casing to establish non-repudiation of hardware ownership
Cevap
The analyst must record cryptographic hashes of the evidence before transfer and document dual sign-off signatures detailing the date, time, and purpose on the chain of custody log.
Maintaining a valid chain of custody requires documenting every transfer of evidence with detailed logs—including date, time, transferor, recipient, and purpose—as well as verifying evidence integrity via cryptographic hashing before and after transfer.
Adım Adım Çözüm
Anahtar Kavram
Digital Forensics Chain of Custody and Evidence Integrity
Tahmini Süre:1m 30s