CS Professional · Internal and Forensic Audit · Cyber Forensics
During a suspected data-theft inquiry at a Pune firm, the forensic auditor must collect evidence from a seized employee laptop. Which step should come first to preserve the integrity of the evidence?
The first step is to make a forensic image of the drive through a write blocker and record its hash value. This preserves the original unaltered and lets analysis proceed on a verified copy, whereas scanning, browsing or reinstalling would modify the evidence.
- ARun a full antivirus scan on the laptop to remove malware
- BCreate a forensic image of the drive using a write blocker and record its hash valueCorrect
- CBrowse the user's files to find the stolen data quickly
- DReinstall the operating system to restore normal functioning
Explanation
Evidence must be preserved before analysis. A bit-by-bit image taken through a write blocker, with a hash recorded, lets the auditor work on a copy and later show the original was unaltered. Scanning, browsing or reinstalling would change the original data and damage its evidential value.
Did you get it right without looking?
One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.
More Cyber Forensics questions
- A disgruntled contractor at a Pune power utility plants malware on the control systems, intending to strike terror in the public. The attack…
- A Central Government notification authorises a government agency to monitor and collect traffic data in order to identify and prevent the sp…
- Under Section 69B of the Information Technology Act, 2000, the Central Government may authorise a government agency to monitor and collect t…
- A forensic auditor at Verma Steels Pvt Ltd finds that the accounts ledger was kept in an electronic file and the same record was saved simul…
- After a ransomware incident, a company's forensic team wants the national agency to coordinate incident response and issue advisories. Under…
- A forensic auditor at Nair Pharma Ltd finds that the original electronic file was lost in a fire, through no default or neglect of the compa…