A high-tech company dealing with sensitive data seized the mobile device of an employee suspected of leaking company secrets to a competitive organization. Which of the following is the BEST order…

Question

Options

• ADevice isolation, evidence intake, device identification, data processing, verification of data
• BEvidence intake, device identification, preparation to identify the necessary tools, device isolation,
• CEvidence log, device isolation ,device identification, preparation to identify the necessary tools,
• DDevice identification, evidence log, preparation to identify the necessary tools, data processing,

• A
  3% (2)
• B
  80% (48)
• C
  12% (7)
• D
  5% (3)

Explanation

Proper digital forensics chain-of-custody procedures require that evidence be formally received and documented before any action is taken on it-this is evidence intake, which records who received the device, when, and its apparent condition. Next, device identification determines the make, model, OS version, and carrier, which directly informs which forensic tools and acquisition methods are appropriate. Only after the device is identified can the examiner prepare the correct tools (option 3). Device isolation (placing in a Faraday bag or enabling airplane mode to block remote wipe commands) is then performed using the correct tools already staged. Finally, data acquisition and processing occur. This order ensures an unbroken chain of custody from receipt and prevents premature isolation actions that could be performed incorrectly. The other options either isolate before documenting (breaking chain of custody), or jump to data processing before the device is properly identified and tools are prepared.

No community discussion yet for this question.