Incident Response

What is the primary purpose of maintaining a chain of custody

To preserve the integrity of evidence for potential legal proceedings

What items must always be included when documenting a chain of custody

• Chronological log of everyone who handled the evidence

• Date and time of evidence transfer

What is the most appropriate next step after a technician discovers evidence of credit card data theft on a company server

Notify management and follow escalation procedures

What is a forensic copy of a storage device that captures every sector of the drive, including deleted files, hidden partitions, and unallocated space

Bit-by-bit image

What ensures the contents of a drive cannot be modified during data acquisition

Write blocker

What provides assurance that a forensic image has not been altered since its creation

Compare the hash values

What type of detail should be strictly avoided to maintain the integrity of the report

Speculative statements

What is the basic order of volatility for a typical system

1. CPU registers/cache

2. RAM

3. Disk

4. Archival media