Evidence handling, chain of custody, and incident response process concepts for digital forensics practitioners.
34 cards · basic cards · AI-written, checked twice. Edit anything.
- What is chain of custody?
Show answer
The documented record of every person who has handled evidence from collection through court.- Why is chain of custody important in digital forensics?
Show answer
It establishes evidence admissibility in court by proving no tampering or contamination occurred.- What must be documented in chain of custody records?
Show answer
Who accessed evidence, when, how long, what was done, and why.- Define evidence integrity in digital forensics.
Show answer
The assurance that evidence has not been altered, modified, or contaminated since collection.- What is a hash value used for in forensics?
Show answer
To create a unique digital fingerprint of data, proving it has not changed.- Name two common hashing algorithms in digital forensics.
Show answer
MD5 and SHA-256 (also SHA-1 or SHA-512 are acceptable).- What does write-blocking mean?
Show answer
Using hardware or software to prevent any data changes during evidence acquisition.- Why use a write-blocker during evidence collection?
Show answer
To prevent accidental or malicious modifications to original evidence during imaging.- Define evidence contamination.
Show answer
Introduction of foreign materials or data that were not present in the original evidence.- When should original media be accessed during investigation?
Show answer
Never. Only forensic images should be analyzed to preserve the original.- What information goes on an evidence label?
Show answer
Case number, description, acquisition date, analyst initials, and hash values.- Name the main phases of incident response.
Show answer
Preparation, detection, analysis, containment, eradication, recovery, and lessons learned.- Define incident detection.
Show answer
The process of discovering and identifying that a security incident has occurred.- What is the goal of the containment phase?
Show answer
To stop the incident from spreading and causing further damage.- Explain evidence preservation in incident response.
Show answer
Collecting and protecting artifacts before they are lost, modified, or overwritten.
FlashKeepers