SY0-301 · Question #364
To ensure proper evidence collection, which of the following steps should be preformed FIRST?
The correct answer is C. Capture the system image. In digital forensics, the order of volatility principle dictates that the most volatile data must be captured first. Capturing a full system image (bit-for-bit disk image) should be done before any other analysis to preserve the entire system state and maintain evidence…
Question
To ensure proper evidence collection, which of the following steps should be preformed FIRST?
Options
- ATake hashes from the live system
- BReview logs
- CCapture the system image
- DCopy all compromised files
How the community answered
(34 responses)- A6% (2)
- C91% (31)
- D3% (1)
Explanation
In digital forensics, the order of volatility principle dictates that the most volatile data must be captured first. Capturing a full system image (bit-for-bit disk image) should be done before any other analysis to preserve the entire system state and maintain evidence integrity. Taking hashes from the live system and copying specific files are done after imaging. Reviewing logs is an analysis activity performed on the image, not on the original system. If you review logs, copy files, or make any changes before imaging, you risk altering or contaminating evidence and potentially invalidating your forensic findings in legal or investigative proceedings.
Topics
Community Discussion
No community discussion yet for this question.