Evidence Collection & Preservation Flashcards

Which NIST publication provides a guide to integrating forensic techniques into incident response?

Answer: NIST SP 800-86

NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) specifically addresses forensic methods within the IR process.

An examiner is analyzing a Windows system and wants to determine recently opened files. Which artifact provides this information?

Answer: Jump Lists and LNK files

Jump Lists and LNK (shortcut) files in Windows record recently accessed files and applications, providing valuable timeline artifacts.

What is the difference between logical acquisition and physical acquisition of a mobile device?

Answer: Logical acquisition is faster but captures only active file system data; physical captures a full bit-for-bit image

Logical acquisition extracts accessible file system data without a full image, while physical acquisition produces a complete bit-for-bit copy including deleted data.

During an incident, a responder powers off a compromised server to 'stop the attack.' What critical evidence is LOST by this action?

Answer: Volatile memory contents including running processes and network connections

Powering off a system immediately destroys all volatile memory contents, including running processes, open network connections, and encryption keys held in RAM.

Which concept describes the documented sequence of custody, control, transfer, and disposition of evidence?

Answer: Chain of custody

Chain of custody is the chronological documentation showing who collected, handled, analyzed, and stored evidence from collection to court presentation.

A forensic analyst finds that a suspect used a live OS booted from USB to perform malicious activity. Why does this complicate evidence recovery?

Answer: Live OS usage typically writes no persistent data to the host hard drive

Live operating systems run entirely from removable media and RAM, leaving little to no persistent evidence on the host system's hard drive.

Under the Federal Rules of Evidence (FRE), what must be demonstrated for digitally extracted records to be considered authentic?

Answer: It must be shown that the evidence is what the proponent claims it to be

FRE Rule 901 requires authentication, meaning the proponent must produce sufficient evidence that the item is what it is claimed to be.