nerdexam
Cisco

210-255 · Question #131

Which statement about collecting data evidence when performing digital forensics is true?

The correct answer is D. It must be preserved and integrity checked. A core principle of digital forensics is that collected evidence must be preserved in its original state and verified using cryptographic integrity checks to remain admissible.

Host-Based Analysis

Question

Which statement about collecting data evidence when performing digital forensics is true?

Options

  • AAllowing unrestricted access to impacted devices
  • BNot allowing items of evidence to be physically touch
  • CPowering off the device after collecting the data
  • DIt must be preserved and integrity checked

How the community answered

(70 responses)
  • A
    3% (2)
  • B
    1% (1)
  • C
    6% (4)
  • D
    90% (63)

Why each option

A core principle of digital forensics is that collected evidence must be preserved in its original state and verified using cryptographic integrity checks to remain admissible.

AAllowing unrestricted access to impacted devices

Allowing unrestricted access to impacted devices contaminates evidence and breaks chain of custody, rendering it inadmissible.

BNot allowing items of evidence to be physically touch

Physical handling of evidence items is permitted and often required under strict documented protocols - prohibiting all physical contact is not a standard forensic requirement.

CPowering off the device after collecting the data

Powering off a device before completing volatile data collection destroys RAM contents, running processes, and other transient evidence.

DIt must be preserved and integrity checkedCorrect

Preserving digital evidence and verifying its integrity through cryptographic hashing - typically MD5 or SHA-256 - ensures the evidence has not been altered since the moment of collection. This integrity verification is required to maintain a defensible chain of custody and to satisfy legal admissibility standards. Without integrity checks, opposing parties can challenge whether evidence was tampered with after collection.

Concept tested: Digital forensics evidence preservation and integrity verification

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf

Topics

#digital forensics#evidence collection#data integrity#chain of custody

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 210-255 Practice