CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run a full antivirus scan on the target drive

  Why it's wrong here

  Running an antivirus scan on the original drive is not forensically sound because the scanner reads and opens files, altering access timestamps, and may write quarantine records, logs, or signature updates to the media. It can also flag and automatically delete or quarantine a suspicious file, destroying potential evidence. Antivirus scanning should be deferred until after a verified forensic image is created and analyzed in a sandbox.

• ✓

  Document all actions taken in a chain of custody form

  Why this is correct

  Maintaining a complete chain of custody form is essential because it documents every interaction with the evidence — who collected it, when, where, and how it was handled, transferred, and secured. In court, opposing counsel will attack a gap in this record as evidence tampering or mishandling. A continuous, written log of all actions taken during acquisition and analysis preserves the integrity narrative and is what makes the forensic evidence legally admissible.

• ✓

  Use a write blocker when imaging a hard drive

  Why this is correct

  A hardware write blocker sits between the suspect drive and the forensic workstation, intercepting and blocking any write commands at the ATA/SCSI level while allowing read commands to pass, so the original media is never modified. This guarantees bit-for-bit preservation of the evidence, including slack space and deleted file remnants that could be altered by software-based tools.

• ✓

  Create a cryptographic hash of the original media before imaging

  Why this is correct

  Before imaging, the analyst computes a cryptographic hash (e.g., SHA-256) of the original media, producing a mathematical fingerprint of every bit. After imaging, the same hash is computed on the image; if the two values match, the copy is byte-for-byte identical and the evidence has not been altered. This hash serves as a baseline for integrity verification throughout the entire investigation and is recorded in the chain of custody.

• ✗

  Boot the system to ensure it is operational

  Why it's wrong here

  Booting the suspect system is dangerous because the operating system immediately writes to the disk — updating logs, prefetch files, registry keys, and user-assist artifacts — and can trigger network communications or anti-forensic mechanisms that overwrite deleted data. It also destroys volatile memory contents that should be captured first under the order of volatility. If booting is absolutely required, it must be done in an isolated lab using a write blocker and with RAM acquired beforehand.

Go deeper

Related to this question