PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 1 : The earlier mount already allowed the OS to write timestamps and metadata, so the source is tainted and must be re-acquired through a hardware blocker

Advertisement

Detailed Solution

सही उत्तर The earlier mount already allowed the OS to write timestamps and metadata, so the source is tainted and must be re-acquired through a hardware blocker है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

An examiner relied on a registry-based software write blocker, but the suspect USB drive had already been mounted once before the blocking policy was applied. What is the forensic consequence? / परीक्षक ने रजिस्ट्री-आधारित सॉफ्टवेयर राइट ब्लॉकर पर भरोसा किया, लेकिन ब्लॉकिंग नीति लागू होने से पहले संदिग्ध USB ड्राइव एक बार माउंट हो चुकी थी। फॉरेंसिक परिणाम क्या है?

1.
The earlier mount already allowed the OS to write timestamps and metadata, so the source is tainted and must be re-acquired through a hardware blocker
2.
No consequence, because registry blockers retroactively undo any writes
3.
The drive is permanently destroyed and no acquisition is possible
4.
Recomputing the hash is enough to restore the evidence's integrity

Correct Answer: The earlier mount already allowed the OS to write timestamps and metadata, so the source is tainted and must be re-acquired through a hardware blocker

Software blocking only prevents future writes from that host; the pre-policy mount already modified access times and journals, so integrity from seizure onward cannot be proven. / सॉफ्टवेयर ब्लॉकिंग सिर्फ भविष्य के राइट रोकता है; नीति से पहले का माउंट पहले ही मेटाडेटा बदल चुका है। Option (b) is the trap — no blocker can undo writes already made.

Downloaded from PrepSnap (prepsnap.in)