712-50 Question 383
Single answerDesign investigation processes such as evidence collection, imaging, data acquisition, and analysisA global manufacturing company suspects that a senior engineer used a company-issued laptop to exfiltrate proprietary design files to a personal cloud account before resigning. The legal team indicates litigation is likely, and the CIO wants the investigation to preserve evidence while minimizing business disruption because the engineer's replacement needs the device quickly. As the CISO designing the investigation process, which action should be taken FIRST to best preserve forensic integrity and support potential legal proceedings?
- A
Create a bit-stream forensic image of the laptop's storage using validated tools, document chain of custody, and perform analysis on the forensic copy rather than the original device.
- B
Ask IT operations to copy the user's Documents and Downloads folders to a secure share so investigators can immediately review likely exfiltrated files.
- C
Allow the replacement engineer to begin using the laptop after deleting obvious personal files, then collect cloud access logs for retrospective analysis.
- D
Have the SOC remotely scan the laptop with the enterprise EDR platform and rely on those scan results as the primary evidence set.
Show answer and explanation
Correct answer: A
Explanation
In a scenario involving potential intellectual property theft and likely litigation, the investigation process should prioritize evidence preservation, legal defensibility, and repeatable methodology. Best practice is to secure the device, document possession and handling through chain-of-custody records, and acquire a forensically sound bit-stream image using validated methods before conducting analysis. This approach is consistent with widely accepted digital forensic principles, including preserving original evidence, minimizing handling of the original media, and maintaining detailed documentation. Guidance from NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) and general forensic practice supports acquiring and analyzing forensic copies rather than working from the live original where feasible. The other options reflect common operational shortcuts, but they sacrifice completeness, integrity, or admissibility.
- A. Correct.
Correct. When litigation is likely, preserving the original evidence in a forensically sound manner is the priority. A bit-stream forensic image captures not only active files but also deleted data, file system metadata, unallocated space, and other artifacts that may be relevant to proving intent, timeline, and scope. Using validated forensic tools, documenting chain of custody, and analyzing only the forensic copy align with standard digital forensics practice and support evidentiary integrity.
- B. Incorrect.
Incorrect. Copying selected folders is faster, but it is not forensically complete and can miss critical artifacts such as deleted files, timestamps, browser artifacts, sync metadata, registry entries, link files, and remnants in unallocated space. It also risks altering access times and fails to preserve the full context needed for legal defensibility.
- C. Incorrect.
Incorrect. Reissuing the laptop before preservation can overwrite or alter valuable evidence, including temporary files, application caches, local sync artifacts, and system logs. Deleting files before evidence collection further compromises integrity. While cloud logs may be useful, they are supplementary and do not replace proper device acquisition.
- D. Incorrect.
Incorrect. EDR telemetry can provide useful leads, but it is not a substitute for forensic imaging when a matter may proceed to litigation. EDR data is selective, may not capture all relevant artifacts, and often lacks the completeness and defensibility of a properly acquired forensic image. Treating it as the primary evidence set is a common but significant mistake.