200-201 Question 205
Single answerDuring an incident investigation, a cybersecurity analyst is tasked with collecting evidence from a compromised server. Which type of evidence is considered the 'best evidence' in this scenario?
- A
A copy of the server's memory (RAM) contents at the time of compromise
- B
A log file showing a record of unauthorized access attempts
- C
A screenshot of the compromised server's desktop
- D
The physical hard drive from the compromised server
Show answer and explanation
Correct answer: D
Explanation
In digital forensics, the 'best evidence' rule prioritizes the original, unaltered source of data whenever possible. A physical hard drive is considered the most reliable source as it provides the ability to conduct detailed forensic analysis and verify the integrity of the evidence. Other forms of evidence, such as logs or screenshots, are supplementary and may not meet the standard of 'best evidence' due to their mutable or incomplete nature.
- A. Incorrect.
While memory (RAM) contents can provide valuable information, they are volatile and do not retain data after a system shutdown, making them less reliable as 'best evidence.'
- B. Incorrect.
Log files are useful for tracking actions or events but can be altered or incomplete, making them less definitive than physical evidence.
- C. Incorrect.
Screenshots provide visual documentation but are not considered 'best evidence' due to the inability to verify or analyze them further.
- D. Correct.
The physical hard drive is considered the 'best evidence' because it contains persistent data that can be forensically analyzed to reconstruct events and verify findings.