312-49v11 practice question 25 of 25

During a forensic investigation into a recent security incident within an organization, the investigator is tasked with documenting every action…

During a forensic investigation into a recent security incident within an organization, the investigator is tasked with documenting every action taken with the evidence to ensure proper chain of custody. The investigator carefully documents every action taken with the evidence in a logbook. The evidence is tagged with unique identifiers to prevent confusion. A detailed chain of custody record is also created to track the evidence's movement and handling throughout the investigation. Which investigation step is the investigator performing in this scenario?

Answer options

A: The investigator is preserving the evidence collected from the incident site. Correct answer

B: The investigator is performing scoping on the location where the security incident took place.

C: The investigator is carrying out data analysis on the evidence for potential findings related to the breach.

D: The investigator is conducting a search and seizure of the evidence related to the security incident.

Correct Answer:

A. The investigator is preserving the evidence collected from the incident site.

Explanation

The actions described—documenting every action in a logbook, tagging evidence with unique identifiers, and creating a detailed chain of custody record—are the core activities of evidence preservation. The purpose of preservation is to maintain the integrity and authenticity of the evidence from the moment of collection until its presentation in court. A meticulously maintained chain of custody is essential to demonstrate that the evidence has not been tampered with or altered in any way, ensuring its admissibility. This step ensures that the evidence is forensically sound and can withstand legal scrutiny.

Why Incorrect

B. Scoping involves defining the boundaries of the investigation (e.g., which systems to examine), which is a planning step that occurs before evidence handling.
C. Data analysis is the technical examination of the evidence's content to find artifacts and information related to the incident, which happens after preservation procedures are in place.
D. Search and seizure is the physical act of locating and taking legal control of the evidence; the scenario describes the procedures followed after seizure.

References

1. Kent

Chevalier

Grance

& Dang

H. (2006). NIST Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.2.2

"Preserve Evidence

" details the need for a chain of custody and proper handling to prevent alteration.

2. U.S. Department of Justice. (2008). Electronic Crime Scene Investigation: A Guide for First Responders (Second Edition). Section 3

"On-Scene Activities

" pages 33-35

emphasizes the critical importance of documenting the collection and handling of electronic evidence to establish the chain of custody.

3. Casey

E. (2011). Digital Evidence and Computer Crime: Forensic Science

Computers

and the Internet (3rd ed.). Academic Press. Chapter 4

"Processing the Crime Scene

" extensively covers evidence handling procedures

including documentation and chain of custody as fundamental to preserving evidence integrity.

Keep practicing

Take the free 312-49v11 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test