English
Menu

Cyber Attacks and Defense in Practice

Evidence from an incident investigation, such as a copy of a disk, is to be handled so that it can later be used in litigation or in a report to the police. Which of the following handling is the most appropriate according to the idea of chain of custody?

  1. ATo speed up the investigation, open and examine the original disk directly, and have the person in charge remember what they noticed without recording it
  2. BOnce a copy has been made the original disk is no longer needed, so wipe it immediately and reuse it in a device for other work to save money
  3. CCopy the original disk through a device that prevents writes, and record the hash values and who received it when and what they did with it
Show answer and explanation

Answer: C. Copy the original disk through a device that prevents writes, and record the hash values and who received it when and what they did with it

For evidence to be trusted in court and elsewhere, it must be shown that there was no tampering or substitution between its collection and its submission. The original media are therefore accessed only through a device that prevents writes (a write blocker), a bit-for-bit copy is made, and it is recorded that the hash values (such as SHA-256) of the original and the copy match. The copy is what gets examined; the original media are sealed and stored, and the date and time, the person in charge and the purpose are recorded at every handover. A break in this record is a reason for the reliability of the evidence to be doubted.

  • A. Examining the original media directly may change their contents, and without records it is impossible to show what was done.
  • B. The original media are kept, among other things, to confirm later that the copy is correct.
  • C. Correct. The key points are showing with hash values that there was no tampering and keeping the record of handovers unbroken.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?
  2. Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?
  3. The logs of two servers are being compared in an intrusion investigation. The web server logs in Coordinated Universal Time (UTC), and its clock was set correctly by NTP. The file server logs in Japan time (UTC+9 hours), and its clock was 4 minutes ahead of the correct time. The web server log records a suspicious login at 01:52 (UTC), and the file server log records a mass read of files at 10:58 (Japan time). How many minutes after the suspicious login did the file reads actually happen?
  4. In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?
  5. Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?

Comparisons in this topic