Electronic Security Forensics Flashcards

An electronic deadbolt shows no signs of physical forced entry, yet the premises were burglarized. The audit log was wiped. What non-destructive forensic technique should be applied to the lock's circuit board?

Answer: Chip-off forensics to extract data directly from memory chips

Chip-off forensics involves desoldering memory chips and reading them directly with specialized equipment, recovering data even when it has been deleted through normal interface methods.

What distinguishes a 'fail-safe' electronic lock from a 'fail-secure' lock in a forensic context where a power interruption was the suspected attack vector?

Answer: Fail-safe locks unlock when power is lost; fail-secure locks remain locked when power is lost

Fail-safe locks (typically used on egress doors) unlock during power loss to allow evacuation, making them vulnerable to deliberate power disruption attacks that would not affect fail-secure locks.

During a forensic investigation, an access control system's event log shows repeated 'anti-passback violation' errors for the same credential. What does this pattern indicate?

Answer: The credential is being used by multiple people or was used to enter without the system registering exit

Anti-passback violations occur when a credential attempts to re-enter without a recorded exit, indicating either card sharing (tailgating without scanning out) or a compromised card being used independently of the original.

A Bluetooth Low Energy (BLE) smart lock is under forensic examination following a suspected breach. Which tool category would be used to analyze captured BLE traffic for credential interception?

Answer: Protocol analyzer with BLE packet capture capability (e.g., Ubertooth, Wireshark with BLE adapter)

BLE protocol analyzers can capture and decode Bluetooth packets, allowing forensic examiners to identify whether credentials were transmitted in plaintext or whether a sniffing attack was feasible.

In electronic security forensics, what does the term 'credential harvesting' mean in the context of access control systems?

Answer: Systematically capturing card data, PINs, or biometric templates to create unauthorized copies

Credential harvesting is the malicious collection of authentication data (card numbers, PINs, biometrics) through skimmers, shoulder surfing, or network interception to enable unauthorized access.

A forensic locksmith discovers that an access-controlled server room was entered using a legitimate credential, but the assigned cardholder's employment was terminated three weeks earlier. What security control failure does this represent?

Answer: Failure to promptly deactivate credentials upon termination (access lifecycle management failure)

Access lifecycle management requires timely deactivation of credentials when employment ends; failure to do so leaves former employees' credentials valid and exploitable — a common source of insider threat incidents.

When preparing a forensic report on an electronic access control breach, what standard should govern the documentation of the electronic evidence collection process?

Answer: NIST SP 800-86 or equivalent digital forensics guidelines for evidence handling and documentation

NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) provides the accepted framework for electronic evidence collection, preservation, examination, and documentation in a forensically sound manner.