CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Documenting the chain of custody for each drive

  Why this is correct

  Chain of custody documentation is critical because it creates a verifiable, chronological record of every person who handled the evidence, along with the time, purpose, and condition of each transfer. In a forensic investigation, this paper trail ensures legal admissibility; if the chain is unbroken, the court can trust that the evidence has not been tampered with or substituted. Without proper documentation, even a technically perfect disk image could be ruled inadmissible, undermining the entire investigation.

• ✗

  Using the fastest available imaging method without verification

  Why it's wrong here

  Prioritizing speed over verification is dangerous because it ignores the central forensic requirement of bit-for-bit accuracy. A fast imaging method might skip bad sectors, use compression that loses data, or fail to create a verifiable hash checkpoint, leaving the image unauthenticated. Since forensic images must be provably identical to the source, any method that sacrifices verification to save time is inherently inadmissible and scientifically unsound.

• ✓

  Computing and verifying hashes (e.g., SHA-256) of the original and the image

  Why this is correct

  Hashing serves as the definitive integrity check in forensic imaging: the SHA-256 algorithm computes a unique 256-bit digest from the source drive's exact data, and the same hash must be regenerated from the acquired image to prove there is zero byte-level discrepancy. This verification step is non-negotiable in court, as it demonstrates that the image is an authentic and unaltered copy of the original. It also provides a way to re-verify the image at any later point, ensuring long-term evidentiary authenticity.

• ✓

  Using a hardware write blocker to prevent writes to the source drive

  Why this is correct

  A hardware write blocker physically intercepts and blocks all write commands from the forensic workstation to the source drive before they reach the storage medium, thereby guaranteeing that no data is modified during acquisition. Unlike software-based write blockers, this hardware-level protection operates independently of the operating system, making it immune to malware or accidental driver writes. This preservation is essential because any change to the source, however minor, can destroy the reliability of the evidence.

• ✗

  Acquiring the image while the system is running (live acquisition)

  Why it's wrong here

  Live acquisition captures the disk while the operating system is active and constantly writing temporary files, logs, and pagefile data, meaning the resulting image will lack a stable, point-in-time snapshot and will contain inconsistencies. For proper disk imaging, the system must be powered off and the drive accessed in a controlled environment with a write blocker; live acquisition is only justified for capturing volatile memory (RAM) that would otherwise be lost. Attempting to create a forensically sound disk image from a live system introduces contamination and undermines the verification process.

Go deeper

Related to this question