nerdexam
CompTIA

SY0-301 · Question #185

Which of the following is a best practice when a mistake is made during a forensics examination?

The correct answer is C. The examiner should document the mistake and workaround the problem.. In forensic examinations, best practice requires documenting every mistake and working around it to preserve chain of custody and maintain the credibility of findings.

Security operations

Question

Which of the following is a best practice when a mistake is made during a forensics examination?

Options

  • AThe examiner should verify the tools before, during, and after an examination.
  • BThe examiner should attempt to hide the mistake during cross-examination.
  • CThe examiner should document the mistake and workaround the problem.
  • DThe examiner should disclose the mistake and assess another area of the disc.

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    90% (18)

Why each option

In forensic examinations, best practice requires documenting every mistake and working around it to preserve chain of custody and maintain the credibility of findings.

AThe examiner should verify the tools before, during, and after an examination.

Verifying tools is a best practice for ensuring reliability before and after an examination, but it does not address the procedural response required when a mistake actually occurs.

BThe examiner should attempt to hide the mistake during cross-examination.

Attempting to hide a mistake is unethical, violates forensic standards, and could constitute obstruction if the case reaches litigation.

CThe examiner should document the mistake and workaround the problem.Correct

Forensic integrity depends on meticulous documentation of all actions, including errors. By recording the mistake and implementing a workaround, the examiner preserves chain of custody, allows peer review of the issue, and ensures the error can be disclosed and explained if the evidence is challenged in court.

DThe examiner should disclose the mistake and assess another area of the disc.

Simply moving to another area of the disc without documenting the mistake fails to maintain a complete and accurate record of the examination process.

Concept tested: Digital forensics chain of custody and error documentation

Source: https://www.nist.gov/system/files/documents/2017/04/28/SP800-86.pdf

Topics

#digital forensics#documentation#chain of custody#incident handling

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice