Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

An incident response team is performing live forensic evidence acquisition on a cloud-hosted virtual machine suspected of being compromised during a data exfiltration attempt. Which of the following actions must the team perform to preserve evidence integrity and maintain a legally defensible chain of custody? (Select TWO.)

  1. Calculate and record SHA-256 cryptographic hash values for all captured memory images and system log files immediately following acquisition.Cevap
  2. B
    Reboot the virtual machine to clear volatile swap space before capturing the primary storage volume image.
  3. Document every evidence transfer, custodian handoff, timestamp, and secure storage location on a standardized evidence log.Cevap
  4. D
    Encrypt the live source storage volume using a public key certificate prior to imaging to enforce non-repudiation.

Cevap

The incident response team must record cryptographic SHA-256 hash values immediately after acquiring evidence and maintain a detailed evidence tracking log documenting every custodian handoff, date, and storage location.
Generating cryptographic hash values immediately upon evidence capture provides a verifiable baseline to prove data integrity. Concurrently, maintaining an explicit chain of custody log detailing every handler, transfer date, and storage location ensures an unbroken line of accountability required for evidence admissibility.

Adım Adım Çözüm

1
Identify requirements for digital evidence preservation and chain of custody.
Proper forensic handling requires verifying data integrity without altering source data and maintaining complete accountability for evidence handling.
Evidence must be verifiable and legally defensible in formal investigations.
2
Evaluate integrity verification controls.
Calculating cryptographic hashes (e.g., SHA-256) right after collection creates an immutable baseline to detect tampering.
Hashing demonstrates that evidence matching the baseline hash has remained unaltered.
3
Evaluate chain of custody documentation controls.
Recording all evidence handoffs, custodian names, dates, and locations maintains an unbroken record of control.
Chain of custody documentation accounts for evidence handling from seizure through presentation.

Anahtar Kavram

Digital Forensics Integrity Verification and Chain of Custody
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru