A security incident occurs that requires a systems administrator to take an image of a user's workstation hard drive. Which of the following should be taken at the time the system image is generated and retained through the file of the investigation to assure files have not been modified since?

Question

Accepted Answer

A. A checksum hash of the drive image or files Generating a checksum hash (such as MD5 or SHA-256) of the drive image at acquisition time creates a unique mathematical fingerprint of the data. If even a single bit changes, the hash value will differ, providing irrefutable proof of integrity and satisfying chain-of-custody requirements for legal or investigative proceedings.

Answer

B. Copies of the system logs at specific intervals System log copies capture events at specific times but do not prove the drive image itself was unaltered, as logs can be modified independently of the image files.

Answer

C. A snapshot of the file system A file system snapshot records the state of the file system at a point in time but does not generate a cryptographic proof that the captured image has remained unchanged.

Answer

D. The user's credentials and permissions User credentials and permissions describe access controls on the live system and have no bearing on whether the acquired forensic image has been tampered with after collection.

A security incident occurs that requires a systems administrator to take an image of a user's workstation hard drive. Which of the following should be taken at the time the system image is generated…

Question

Options

How the community answered

Why each option

Topics

Community Discussion