Some hard disks need to be taken as evidence for further analysis during an incident response. Which of the following procedures must be completed FIRST for this type of evidence acquisition?

The correct answer is B. Build the chain-of-custody document, noting the media model, serial number, size, vendor, date,. Chain of custody should be done before taking a copy of data, because this defines what tools were used to obtain the data/who handled the copying. This is a crucial step for submitting data to court because this can help (along with hashing obv) prove the integrity of data.

Submitted by lars.no· Mar 6, 2026Incident Response and Management

Question

Options

AExtract the hard drives from the compromised machines and then plug them into a forensics
BBuild the chain-of-custody document, noting the media model, serial number, size, vendor, date,
CPerform a disk sanitization using the command #dd if=/dev/zero of=/dev/sdc bs=1M over the
DExecute the command #dd if-/dev/sda of=/dev/sdc bs=512 to clone the evidence data to external

How the community answered

(40 responses)

A
3% (1)
B
78% (31)
C
5% (2)
D
15% (6)

Explanation

Chain of custody should be done before taking a copy of data, because this defines what tools were used to obtain the data/who handled the copying. This is a crucial step for submitting data to court because this can help (along with hashing obv) prove the integrity of data.

Topics

#chain of custody#digital forensics#evidence acquisition#incident response

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice