A user has been reported for storing prohibited material on a company owned PC. The accused user is notified and an investigation is launched. However, no evidence is found and it is believed that…

The correct answer is D. Data preservation. Data preservation (also called a legal hold) is a policy or technical control that prevents data from being altered or deleted when an investigation is pending or anticipated. Had a data preservation policy been in place before the user was notified, the system could have been…

Hardware and network troubleshooting

Question

A user has been reported for storing prohibited material on a company owned PC. The accused user is notified and an investigation is launched. However, no evidence is found and it is believed that the user was able to delete all relevant evidence. Which of the following would prevent this from happening in the future?

Options

AChange documentation
BChain of Custody
CAutomatic notifications for complaints
DData preservation

How the community answered

(32 responses)

A
6% (2)
B
16% (5)
C
6% (2)
D
72% (23)

Explanation

Data preservation (also called a legal hold) is a policy or technical control that prevents data from being altered or deleted when an investigation is pending or anticipated. Had a data preservation policy been in place before the user was notified, the system could have been locked down or the data snapshot preserved, preventing evidence tampering. Chain of custody documents how evidence is handled after collection but does not prevent deletion before an investigation begins. Change documentation and automatic notifications do not address evidence retention.

Topics

#data preservation#digital forensics#evidence management#chain of custody

Community Discussion

No community discussion yet for this question.

Full 220-801 Practice