712-50 Question 386
Single answerConfigure and use various forensic investigation toolsA global manufacturing company suspects that an engineer used a company-issued Windows laptop to exfiltrate proprietary CAD files before resigning. Legal counsel has indicated that the evidence may be used in both civil litigation and a potential criminal referral. The CISO wants the investigation team to quickly identify whether USB devices, file-copy activity, and cloud-sync artifacts are present, while preserving evidence in a forensically sound manner. Which action should the CISO direct FIRST to best support both rapid analysis and evidentiary integrity?
- A
Have the analyst log into the laptop with an administrator account, use native Windows tools to review recent files and USB history, and then copy any suspicious artifacts to a network share for later review
- B
Create a bit-for-bit forensic image using a validated imaging tool with write-blocking where applicable, calculate and record cryptographic hash values, and perform analysis on the verified copy with forensic suites capable of parsing Windows artifacts
- C
Run an endpoint detection and response (EDR) live response collection to gather the user profile, browser history, and event logs, since enterprise tools are faster than traditional forensic acquisition
- D
Ask IT to restore the user's OneDrive and endpoint backup to a sandbox system and analyze the restored data, because backup copies are easier to access than collecting from the original device
Show answer and explanation
Correct answer: B
Explanation
When legal admissibility and executive-level risk are involved, the CISO should prioritize a defensible forensic process over convenience. Best practice is to preserve the original evidence by creating a forensic image, verifying integrity with cryptographic hashes, documenting chain of custody, and conducting analysis on a verified copy. This approach is consistent with common digital forensics principles reflected in NIST guidance such as NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) and NIST SP 800-101 for digital evidence handling concepts. In a Windows exfiltration case, forensic suites can then be configured to examine artifacts relevant to the scenario, including USB device history from registry keys, shellbags, LNK files, jump lists, recent files, event logs, browser artifacts, and cloud synchronization traces from clients such as OneDrive. EDR and backups may provide useful supplemental data, but they should not replace a proper forensic acquisition when the matter may proceed to court.
- A. Incorrect.
This is incorrect because directly logging into the original system and using native tools changes timestamps, registry entries, link files, event logs, and other artifacts, undermining evidentiary integrity. Copying selected artifacts to a network share also risks incomplete collection and weakens chain of custody. This reflects a common misconception that speed should take priority over preserving original evidence when legal action is likely.
- B. Correct.
This is correct because a forensically sound acquisition of the original media is the preferred first step when evidence may be used in litigation or criminal proceedings. A bit-stream image preserves deleted data, unallocated space, file system metadata, and artifacts needed to examine USB usage, file access, and cloud-sync traces. Using validated forensic imaging tools, write-blocking where applicable, and recording cryptographic hashes supports integrity verification and chain of custody. Analysis should then occur on the forensic copy with tools that can parse artifacts such as Windows Registry hives, shellbags, LNK files, jump lists, event logs, browser data, and cloud client remnants.
- C. Incorrect.
This is incorrect because live response can be useful in some incidents, especially when systems cannot be taken offline or volatile data is critical, but it is not the best first step here for evidence expected to support litigation. EDR collection may not capture all relevant file system artifacts, deleted data, or unallocated space, and its collection process can alter the endpoint. It is a useful supplementary source, not a substitute for forensic acquisition in this scenario.
- D. Incorrect.
This is incorrect because backups and cloud restores may be incomplete, may omit key metadata, and do not represent the original state of the endpoint at the time of suspected exfiltration. They can be helpful for corroboration or business recovery, but relying on them first can miss device-specific artifacts such as USB insertion history, local sync client logs, registry evidence, and deleted files. This option confuses operational convenience with forensic sufficiency.