Question

Answer (Detailed Solution Below)

Option 2 : Direct access alters the evidence; a bit-stream image must be acquired first through a hardware write blocker

Detailed Solution

सही उत्तर Direct access alters the evidence; a bit-stream image must be acquired first through a hardware write blocker है।

Key Points

Helpful?

prepsnap.in • Part -A

Question:

A suspect's laptop is seized while powered on. The examiner immediately connects the internal SSD to a workstation with a USB adapter and starts browsing folders to "see what's there" before imaging. Which forensic principle is violated first, and what should have been done? / संदिग्ध का लैपटॉप चालू हालत में जब्त किया गया। परीक्षक ने इमेजिंग से पहले SSD को USB एडाप्टर से वर्कस्टेशन से जोड़कर फोल्डर ब्राउज़ करना शुरू कर दिया। सबसे पहले कौन-सा फॉरेंसिक सिद्धांत टूटा और क्या करना चाहिए था?

The chain of custody form was not signed; imaging can wait until the form is complete

Direct access alters the evidence; a bit-stream image must be acquired first through a hardware write blocker

The SSD should have been imaged over the network instead of being removed

Browsing is acceptable as long as no files are opened, only folder names are viewed

Correct Answer: Direct access alters the evidence; a bit-stream image must be acquired first through a hardware write blocker

Any direct mounting lets the OS write timestamps, journal entries and thumbnail caches, destroying integrity — the correct first step is a bit-stream copy via a hardware write blocker, then hash-verify before analysis. / OS माउंट करते ही टाइमस्टैम्प और जर्नल बदल देता है; सही पहला कदम हार्डवेयर राइट ब्लॉकर से बिट-स्ट्रीम इमेज लेकर हैश सत्यापित करना है। Option (d) is the trap: merely listing directories updates access times and journal metadata.

Downloaded from PrepSnap (prepsnap.in)