CS0-003 Practice Question: During a security incident, a digital forensics…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Calculate and document cryptographic hashes of acquired images.

  Why this is correct

  Calculating a cryptographic hash (e.g., SHA-256) of an acquired disk image immediately after creation generates a unique digital fingerprint that can later be re-computed to verify the image has not been modified or corrupted. This integrity verification is a fundamental forensic requirement and must be documented in the case notes, along with the exact hash value, so that courts can substantiate that the evidence is authentic and unaltered since acquisition. Without this step, any subsequent analysis could be called into question, and the entire evidentiary foundation would be vulnerable to challenges.

• ✗

  Boot the suspect system to check for running processes.

  Why it's wrong here

  Booting the suspect system, particularly in normal mode, initiates the operating system and writes data to the disk—changing file access times, creating temporary files, and potentially altering user data or logs. This violates the core forensic principle of preserving evidence in its original state, as any modification can destroy or contaminate proof. Even if the system is booted from a live CD, the system's devices may still generate write activity, and performing a live boot is only justified in specific, carefully controlled scenarios where volatile data must be captured before powering down. In a routine forensic acquisition, the correct procedure is to keep the system powered off and use static imaging techniques.

• ✓

  Maintain a documented chain of custody for all evidence.

  Why this is correct

  Maintaining a documented chain of custody is essential because it provides a chronological, auditable record of every person who handled the evidence, the times and dates of transfers, and the conditions under which it was stored. This documentation demonstrates that the evidence has not been tampered with, lost, or substituted, which is a prerequisite for admissibility in legal proceedings. Even with perfect acquisition techniques, a gap or inconsistency in the chain of custody can render the evidence worthless in court. Therefore, the investigator must meticulously log every action—from collection, through storage, to analysis—and ensure that any transfer is signed for and witnessed to maintain the integrity of the case.

• ✓

  Use a write blocker when creating disk images.

  Why this is correct

  A write blocker is a specialized hardware or software device that intercepts and blocks write commands from being sent to a suspect drive during the imaging process. By allowing only read operations, it guarantees that the original evidence disk remains absolutely untouched, preserving its exact state, metadata, timestamps, and all data. Without a write blocker, the mere act of connecting the drive to a forensic workstation could cause the operating system to alter the drive—for instance, by updating access times, creating system restore points, or writing journal data—thereby compromising the evidence's integrity. Hardware write blockers are preferred in high-stakes investigations because they act at the physical layer and are not reliant on the host operating system's software, whereas software write blockers can be bypassed by malicious code.

• ✗

  Store original evidence on the same network as the investigation.

  Why it's wrong here

  Storing original evidence on the same network as the investigation introduces a severe risk of corruption, accidental modification, or unauthorized access. For example, if the network is compromised by malware, the evidence files or the forensic images could be infected or altered, breaking their integrity and making them inadmissible in court. Additionally, network storage may have automated backup or indexing processes that modify file timestamps, and it can be accessible to other users, which creates a chain-of-custody violation. Original evidence should be stored on write-protected media in a physically secured, isolated evidence locker, ensuring that it is never exposed to a network environment that could change or contaminate it.

• ✗

  Reinstall the operating system before imaging to ensure stability.

  Why it's wrong here

  Reinstalling the operating system before imaging would completely obliterate the original evidence—the process overwrites the disk's contents, destroys user files, deletes logs, and replaces system artifacts—thereby defeating the entire purpose of forensic preservation. The goal of digital forensics is to recover and analyze the evidence exactly as it existed at the time of the incident, not to create a clean or stable environment for the investigator. An unstable system does not justify such a destructive action; if a system is unstable, the investigator should still follow proper procedures for imaging the original media, even if it requires additional care or specialized tools. Reinstalling the OS would be tantamount to destroying evidence and could lead to criminal charges for obstruction of justice or evidence tampering.

Go deeper

Related to this question