220-801 · Question #272
After identifying illegal activity on a small business computer, a business owner asks the office secretary to log into the system to retrieve various files. Which of the following aspects of…
The correct answer is A. Data preservation. Data preservation requires that potential digital evidence be kept in its original, unaltered state. Having the secretary log in and retrieve files actively modifies the system - access timestamps change, files may be moved or copied, and the integrity of the original evidence…
Question
After identifying illegal activity on a small business computer, a business owner asks the office secretary to log into the system to retrieve various files. Which of the following aspects of procedural forensic analysis were violated in this scenario?
Options
- AData preservation
- BProper channel reporting
- CInitial response identification
- DTracking of documentation
How the community answered
(47 responses)- A64% (30)
- B21% (10)
- C4% (2)
- D11% (5)
Explanation
Data preservation requires that potential digital evidence be kept in its original, unaltered state. Having the secretary log in and retrieve files actively modifies the system - access timestamps change, files may be moved or copied, and the integrity of the original evidence is compromised. This can render the evidence inadmissible in court. The correct procedure is to isolate the system, avoid any access, and allow trained forensic investigators to create a verified bit-for-bit image before any analysis occurs. The other options (proper channel reporting, initial response identification, tracking of documentation) were not specifically violated by the described action of logging in and retrieving files.
Topics
Community Discussion
No community discussion yet for this question.