300-215 Question 170
Select 3During an incident response investigation, your team is tasked with preserving volatile memory data from a compromised endpoint. Which of the following steps are part of a proper forensic process to ensure the integrity and admissibility of the evidence?
- A
Capture the memory image using a trusted forensic tool.
- B
Directly analyze the memory on the live system without copying it.
- C
Document the exact date, time, and method used to collect the memory image.
- D
Ensure the memory image file is hashed and the hash value is recorded.
- E
Immediately send the memory image to the development team for analysis without documentation.
Show answer and explanation
Correct answers: A, C, D
Explanation
Proper forensic processes require careful collection, documentation, and preservation of evidence to maintain its integrity and admissibility in investigations and potential legal proceedings. Capturing the image using trusted tools (Option 1), maintaining thorough documentation (Option 3), and hashing the data for integrity verification (Option 4) are key steps. Actions that compromise the evidence, such as direct analysis on a live system (Option 2) or failing to document actions (Option 5), should be avoided.
- A. Correct.
Capturing the memory image using a trusted forensic tool is a critical step to ensure the data is collected accurately and without modification.
- B. Incorrect.
Analyzing the memory directly on the live system can alter the volatile data and compromise the integrity of the evidence.
- C. Correct.
Documenting the exact date, time, and method used to collect the memory image is necessary to establish a chain of custody and maintain admissibility in legal proceedings.
- D. Correct.
Hashing the memory image and recording the hash value ensures that the integrity of the evidence can be verified during further analysis.
- E. Incorrect.
Sending the memory image to the development team without documentation breaks the chain of custody and risks compromising the evidence’s reliability.