A security investigator is tasked with preserving digital evidence from a workstation suspected of being involved in unauthorized file transfers. Which of the following procedures must the investigator follow to ensure evidence integrity and maintain a legally defensible chain of custody? (Select TWO.)
- Calculate and log cryptographic hash values of the storage media immediately upon acquisition and after creating an image.Cevap
- Record every transfer of evidence, including dates, times, handler identities, and transfer purposes on a standardized form.Cevap
- CReboot the workstation into safe mode prior to disk acquisition to stop malicious background processes.
- DStore the acquired evidence on an open network share so multiple incident response team members can access it concurrently.
Cevap
The investigator must calculate cryptographic hash values to verify data integrity and maintain a complete log of evidence transfers, timestamps, and handlers to preserve the chain of custody.
Computing cryptographic hashes guarantees that the bit-stream copy exactly matches the source media at the point of acquisition. Documenting all evidence handlers, timestamps, and transfer reasons provides proof of possession and prevents claims of evidence tampering.
Adım Adım Çözüm
Anahtar Kavram
Evidence Preservation and Chain of Custody Maintenance