Electronic Security Forensics Flashcards

A key fob for a wireless electronic lock uses rolling codes. What forensic implication does a captured but UNUSED rolling code have for investigators?

Answer: It is valid for only one use and becomes invalid after the next legitimate transmission

Rolling codes change with each use, so a captured unused code may still be valid once, but becomes permanently invalid after the next legitimate fob transmission due to counter advancement.

What is the forensic importance of examining the 'door held open' alarm records in an access control system?

Answer: They reveal instances where a door was propped open, potentially allowing unauthorized access without credential use

Door held open alarms document when a secured door remained open longer than the allowed time, which can indicate propping for unauthorized entry or exit — bypassing the credential requirement entirely.

During investigation of a healthcare facility breach, the forensic locksmith discovers the access control system uses a centralized database. What additional evidence source should be cross-referenced with the door access logs?

Answer: Network authentication logs (e.g., Active Directory or LDAP)

Cross-referencing door access logs with network authentication logs helps verify whether the person using a credential was also logged into network systems, confirming presence or identifying impossible travel scenarios.

A forensic locksmith is asked to determine if an electronic safe's keypad was bypassed. Which physical evidence on the keypad would be MOST indicative of a bypass attack using a known manufacturer vulnerability?

Answer: Signs of a secondary device connection at the keypad's service port or diagnostic connector

Some electronic safe manufacturers include service or diagnostic ports that, when exploited with specific sequences or tools, can bypass PIN requirements — physical evidence of such connections is highly significant.

What is a 'relay attack' in the context of proximity card access control systems?

Answer: Extending the communication range between a card and reader using two devices to defeat proximity requirements

A relay attack uses two coordinated devices to tunnel the RF communication between a legitimate card and reader over a distance, making the system 'believe' the card is present when it is not.

When a video surveillance system is integrated with access control, what is the PRIMARY forensic benefit of synchronized timestamps between systems?

Answer: Ability to correlate a specific door event with corresponding video footage of who triggered it

Synchronized timestamps allow investigators to pull video footage from the exact moment a specific access event occurred, visually identifying who presented the credential or committed the breach.

A forensic examination reveals an access control credential database was modified to add unauthorized cards. What forensic artifact would BEST identify when this modification occurred?

Answer: Database transaction logs or change audit trail with timestamps

Database transaction logs record all changes with timestamps and user credentials, providing a precise record of when unauthorized cards were added and potentially identifying who made the changes.