Examkin

Soru

Zorluk: ZorDigital Forensics and Chain of Custody

During an incident response investigation involving suspected database exfiltration on a live cloud-hosted virtual server, a security analyst must preserve system evidence while maintaining strict chain of custody compliance for potential legal proceedings. Which of the following procedures should the analyst perform immediately following the acquisition of the system's volatile memory?

  1. A
    Power off the virtual server instance immediately to freeze disk states before capturing persistent storage.
  2. Generate a cryptographic hash digest of the captured memory file and record the hash, timestamp, and analyst identity in the custody log.Cevap
  3. C
    Encrypt the raw memory dump using an asymmetric public key to ensure non-repudiation of the evidence without generating a separate checksum.
  4. D
    Export active operating system event logs directly to a central syslog server to secure system events prior to documenting evidence transfer.

Cevap

Generate a cryptographic hash digest of the captured memory file and record the hash, timestamp, and analyst identity in the custody log.
In digital forensics, establishing evidence integrity requires calculating a cryptographic hash (e.g., SHA-256) immediately after image acquisition. Logging the resulting hash along with acquisition details, timestamps, and investigator credentials establishes a verified chain of custody ensuring the evidence remains untampered.

Adım Adım Çözüm

1
Acquire volatile RAM image
Volatile evidence preserved from the live virtual instance.
RAM contains perishable artifacts such as active connections, running processes, and decrypted keys.
2
Generate a cryptographic hash of the memory image
Creates a unique digital fingerprint (e.g., SHA-256 checksum) of the original evidence file.
Establishes a baseline integrity reference to prove the evidence has not been modified.
3
Document transfer in the chain of custody log
Records date, time, practitioner identity, hardware details, and hash digest.
Ensures complete traceability and legal admissibility of evidence from collection through court presentation.

Anahtar Kavram

Forensic Evidence Integrity and Chain of Custody Documentation
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru