Immediately following the report of a potential breach, a security engineer creates a forensic image of the server in question as part of the organization incident response procedure. Which of the…

Question

Options

• AThe image must be password protected against changes.
• BA hash value of the image must be computed.
• CThe disk containing the image must be placed in a seated container.
• DA duplicate copy of the image must be maintained

• A
  5% (2)
• B
  93% (40)
• D
  2% (1)

Explanation

Forensic integrity is established through cryptographic hashing (typically MD5, SHA-1, or SHA-256). Computing a hash of the forensic image creates a unique fixed-length fingerprint of the image at the exact moment of capture. If the image is ever questioned in legal proceedings or an investigation, the hash can be recomputed and compared to the original - any discrepancy indicates tampering or corruption. This is the foundational chain-of-custody requirement in digital forensics. Password protection (A) controls access but does not prove integrity. A sealed container (C) is a physical chain-of-custody control, not a data integrity control. Maintaining a duplicate copy (D) is good practice for availability and redundancy but does not by itself prove the image is unaltered.

No community discussion yet for this question.