An effective method of remotely collecting logs (as evidence) is to TFTP the files and then hash them.

Question

Options

• ATrue
• BFalse

• A
  20% (8)
• B
  80% (32)

Explanation

Option B (False) is correct because TFTP (Trivial File Transfer Protocol) is an unauthenticated, unencrypted protocol with no built-in integrity verification - making it forensically unsound for evidence collection. The critical flaw in this method is the order of operations: hashing files after an insecure transfer cannot prove the files weren't altered in transit or during acquisition, breaking the chain of custody. Proper forensic procedure requires hashing at the source before transfer (using a secure, authenticated protocol like SCP or SFTP), then re-hashing after receipt to confirm the values match.

Option A is wrong because it conflates "collecting logs remotely" with "collecting them properly" - TFTP can move files, but it cannot preserve their evidentiary integrity.

Memory tip: Think "hash first, transfer second" - if you hash after an untrusted transfer, you're only proving what you received, not what was originally there. In forensics, integrity must be established at the source.

No community discussion yet for this question.