GIAC
GCED · Question #93
Which type of media should the IR team be handling as they seek to understand the root cause of an incident?
The correct answer is A. Restored media from full backup of the infected host. By imaging the media with tools such as dd or Ghost and analyzing the copy, you preserve the original media for later analysis so that the results can be recreated by another competent examiner if necessary.
Data Protection and Incident Response
Question
Which type of media should the IR team be handling as they seek to understand the root cause of an incident?
Options
- ARestored media from full backup of the infected host
- BMedia from the infected host, copied to the dedicated IR host
- COriginal media from the infected host
- DBit-for-bit image from the infected host
How the community answered
(18 responses)- A72% (13)
- B6% (1)
- C17% (3)
- D6% (1)
Explanation
By imaging the media with tools such as dd or Ghost and analyzing the copy, you preserve the original media for later analysis so that the results can be recreated by another competent examiner if necessary.
Topics
#forensic evidence handling#IR media#working copy#incident response procedures
Community Discussion
No community discussion yet for this question.