A customer is terminating an employee for suspected activity that is against company policy. They have called Ann to consult with them on how to best preserve any evidence the company may be…

Question

Options

• ACreate an image of the hard drive and store it on a NTFS drive.
• BRemove and secure any HDD from the computer, documenting the process.
• CStore the computer in the server room until it is required.
• DLock the user out of the computer and let another employee use it until needed.

• A
  23% (7)
• B
  61% (19)
• C
  10% (3)
• D
  6% (2)

Explanation

In digital forensics and legal proceedings, maintaining the chain of custody and preserving evidence integrity is paramount. Physically removing the hard drive and securing it - while thoroughly documenting each step of the process - establishes a defensible chain of custody that courts require. Creating a drive image (Option A) is a valid forensic technique but storing it on an NTFS drive does not address chain of custody documentation. Storing the computer in a server room (Option C) leaves the evidence accessible and undocumented. Allowing another employee to use the locked computer (Option D) would contaminate and potentially destroy evidence. Option B is the only choice that isolates, secures, and documents the evidence correctly.

No community discussion yet for this question.