Which of the following BEST protects evidence in a forensic investigation?

The most effective method to protect digital evidence is to create a forensic image of the affected system's storage media. Imaging involves creating a bit-for-bit copy of the entire drive, including deleted files and unallocated space. This process preserves the original evidence in its exact state at the time of collection. All subsequent analysis is performed on this verified copy, ensuring the original media remains unaltered and its integrity is maintained. This is a fundamental principle in digital forensics, crucial for ensuring the evidence is admissible in legal or disciplinary proceedings.

B. Powering down the affected system immediately destroys volatile evidence stored in RAM, such as running processes, network connections, and cached data, which can be critical.

C. Protecting the hardware is a necessary physical security measure for chain of custody but does not preserve the digital state of the evidence on the system.

D. Rebooting the affected system is a destructive act that clears volatile memory and alters non-volatile data by writing new log files and temporary data, contaminating the evidence.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 4.7 Incident Management. The manual emphasizes that a primary objective during evidence collection is to preserve the evidence. It specifies the use of bit-stream imaging to create a copy of the storage media for analysis

leaving the original evidence intact.

2. National Institute of Standards and Technology (NIST)

Special Publication 800-86

"Guide to Integrating Forensic Techniques into Incident Response." Section 3.2.3

"Creating a Forensic Image of Media

" states

"Creating an image is a critical step in a forensic examination. The image provides an exact duplicate of the media that the examiner can work with

leaving the original media untouched." This directly supports imaging as the best protection method.

3. Kent

K.

Chevalier

S.

Grance

T.

& Dang

H. (2006). NIST Special Publication 800-86

"Guide to Integrating Forensic Techniques into Incident Response." Section 3.1

"Initial Response

" discusses the order of volatility and warns against actions that could alter or destroy evidence. It implicitly advises against premature shutdown (Option B) or rebooting (Option D) before volatile data is captured and the system is imaged.