Examkin

Soru

Zorluk: OrtaDigital Forensics and Chain of Custody

A digital forensic examiner receives a powered-off workstation hard drive confiscated during an insider threat investigation. The examiner needs to duplicate the physical drive onto a forensic storage unit for analysis while ensuring evidence admissibility in court. Which of the following actions should the examiner take FIRST?

  1. Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.Cevap
  2. B
    Boot the workstation using its native operating system to verify that the file system is intact.
  3. C
    Encrypt the physical drive using a single symmetric key to establish non-repudiation.
  4. D
    Mount the target storage drive in read-write mode to expedite checksum calculations.

Cevap

Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.
Attaching the drive to a hardware write-blocker prevents any write signals from reaching the source disk, guaranteeing that no file timestamps or data blocks are altered during the acquisition phase.

Adım Adım Çözüm

1
Identify the primary requirement for disk-based evidence acquisition.
The target physical storage device must be protected against any write commands from the acquiring system.
Operating systems automatically write hidden system metadata, update access timestamps, or modify logs when storage drives are attached without hardware write protection.
2
Select the appropriate control for physical disk evidence protection.
Interpose a hardware write-blocker between the original suspect storage drive and the forensic analysis machine.
Hardware write-blockers intercept write commands at the controller layer, ensuring bit-for-bit acquisition without altering the source media.

Anahtar Kavram

Write-Blocker Utilization and Forensics Integrity
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru