nerdexam
CompTIA

CAS-002 · Question #663

A production server has been compromised. Which of the following is the BEST way to preserve the non-volatile evidence?

The correct answer is A. Shut the server down and image the hard drive. Preserving non-volatile evidence requires a forensically sound disk image taken after a controlled shutdown to capture persistent storage state without corrupting or altering the data.

Enterprise Security

Question

A production server has been compromised. Which of the following is the BEST way to preserve the non-volatile evidence?

Options

  • AShut the server down and image the hard drive.
  • BRemove all power sources from the server.
  • CInstall remote backup software and copy data to write-once media.
  • DLogin remotely and perform a full backup of the server.

How the community answered

(23 responses)
  • A
    91% (21)
  • B
    4% (1)
  • C
    4% (1)

Why each option

Preserving non-volatile evidence requires a forensically sound disk image taken after a controlled shutdown to capture persistent storage state without corrupting or altering the data.

AShut the server down and image the hard drive.Correct

Non-volatile evidence resides on persistent storage such as hard drives, which retain data after power loss. A controlled shutdown followed by a bit-for-bit disk image preserves the disk state in a forensically sound manner, maintaining evidence integrity and chain of custody. This allows analysis to be performed on the image rather than the original media, preventing inadvertent modification.

BRemove all power sources from the server.

Abruptly removing all power sources can cause file system corruption and incomplete writes, potentially destroying the non-volatile evidence that needs to be preserved.

CInstall remote backup software and copy data to write-once media.

Installing remote backup software modifies system state, potentially overwrites slack space or evidence, and introduces untrusted code onto a compromised server, violating forensic integrity.

DLogin remotely and perform a full backup of the server.

Logging in remotely and performing a full backup alters file access timestamps and log entries, compromising the forensic integrity of the non-volatile evidence.

Concept tested: Non-volatile digital forensic evidence preservation

Source: https://csrc.nist.gov/publications/detail/sp/800-86/final

Topics

#digital forensics#evidence preservation#disk imaging#incident response

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice