A recent computer breach has resulted in the incident response team needing to perform a forensics examination. Upon examination, the forensics examiner determines that they cannot tell which captured

The correct answer is C. Evidence labeling. Evidence labeling is the practice of clearly marking and tagging each piece of collected evidence with identifying information (e.g., case number, device description, date/time collected, examiner name). Without proper labeling, examiners cannot distinguish one piece of evidence

Security operations

Question

A recent computer breach has resulted in the incident response team needing to perform a forensics examination. Upon examination, the forensics examiner determines that they cannot tell which captured hard drive was from the device in question. Which of the following would have prevented the confusion experienced during this examination?

Options

APerform routine audit
BChain of custody
CEvidence labeling
DHashing the evidence

How the community answered

(48 responses)

A
4% (2)
B
2% (1)
C
92% (44)
D
2% (1)

Explanation

Evidence labeling is the practice of clearly marking and tagging each piece of collected evidence with identifying information (e.g., case number, device description, date/time collected, examiner name). Without proper labeling, examiners cannot distinguish one piece of evidence from another, which is exactly the problem described. While chain of custody (B) tracks who handled evidence and when, and hashing (D) verifies integrity, neither addresses the inability to identify which physical drive belongs to which device. Labeling directly prevents the confusion of not knowing which hard drive came from which machine.

Topics

#forensics#evidence labeling#chain of custody#incident response

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice