Evidence handling, chain of custody, and incident response process concepts for digital forensics practitioners.
34 cards · basic cards · AI-written, checked twice. Edit anything.
- What is chain of custody?
- The documented record of every person who has handled evidence from collection through court.
- Why is chain of custody important in digital forensics?
- It establishes evidence admissibility in court by proving no tampering or contamination occurred.
- What must be documented in chain of custody records?
- Who accessed evidence, when, how long, what was done, and why.
- Define evidence integrity in digital forensics.
- The assurance that evidence has not been altered, modified, or contaminated since collection.
- What is a hash value used for in forensics?
- To create a unique digital fingerprint of data, proving it has not changed.
- Name two common hashing algorithms in digital forensics.
- MD5 and SHA-256 (also SHA-1 or SHA-512 are acceptable).
- What does write-blocking mean?
- Using hardware or software to prevent any data changes during evidence acquisition.
- Why use a write-blocker during evidence collection?
- To prevent accidental or malicious modifications to original evidence during imaging.
- Define evidence contamination.
- Introduction of foreign materials or data that were not present in the original evidence.
- When should original media be accessed during investigation?
- Never. Only forensic images should be analyzed to preserve the original.
- What information goes on an evidence label?
- Case number, description, acquisition date, analyst initials, and hash values.
- Name the main phases of incident response.
- Preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
- Define incident detection.
- The process of discovering and identifying that a security incident has occurred.
- What is the goal of the containment phase?
- To stop the incident from spreading and causing further damage.
- Explain evidence preservation in incident response.
- Collecting and protecting artifacts before they are lost, modified, or overwritten.