Exam CISM topic 1 question 534 discussion

You obtain a hash value of a hard disk first before capturing an image. Capturing an image and hashing it after will not be the same hash after you restore the image. Hash first, image next, restore then, compare hash.

B. hash it first and then capture an image, once you restore the image, you compare the hash for integrity.

Phases in a cyber forensic procedure: - Identification: Determining which evidence is required for the purpose. - Preservation: Deciding how to maintain the integrity and security of extracted evidence. - Analysis: Understanding the insights the information does (and does not) provide. - Documentation. ... - Presentation. So apparently, you calculate the hash first, before you touch anything. In reality, imaging software usually does this (calculates hash value) in the process of creating a bit-for-bit copy of the source.

which one is frist is forensic image or generate the hash for data integrity ChatGPT In a typical digital forensic investigation or data integrity verification process, creating a forensic image is generally performed before generating a hash for data integrity. Forensic Image Creation: The first step often involves creating a forensic image of the original storage media or system. This image is an exact copy of the entire storage device, capturing not only the data but also the structure and metadata. Creating a forensic image is crucial to preserve the original evidence without altering or contaminating it during the investigation. Generating Hash for Data Integrity: Once the forensic image is created, the next step is often to generate a hash value (checksum) for the image file. A hash function processes the entire content of the file and produces a fixed-size hash value. This hash value serves as a digital fingerprint for the forensic image.

Took a forensics class, you got to hash first.

D. Capture a forensic image of the computer. is the best answer here. You will need to obtain a hash of the desktop computer's internal hard drive for the purposes of integrity only after taking a forensic image. The hash will help monitor that nothing is changed or altered after the forensic image has been taken. So first you take a forensic image and then second you obtain a hash for integrity purposes. D. Capture a forensic image of the computer. is the correct answer for sure.

The first step should be to capture a forensic image of the computer. A forensic image is a bit-by-bit copy of the entire hard drive that preserves the original data and metadata. It is important to have an exact replica of the computer's hard drive to ensure the integrity of the evidence. Once the forensic image is captured, it can be analyzed and examined without altering the original data. This will allow investigators to identify and secure any incriminating evidence on the computer while maintaining its original state.

B. Obtain a hash of the desktop computer's internal hard drive. Its best practice to obtain the hash (checksum) of a computer hard drive before making a forensic copy of the drive in digital forensics. "hashing before acquisition"

Option D

If you want the evidence to be admissible in court, then first hash the original, and take a copy, then hash the copy, and both hashes shall be the same. So, B is the correct answer.

B Is correct answer here

B Is correct answer here. When gathering information from storage devices, analysts should never access hard drives or other media from a live system. Instead, they should power off the system (after collecting other evidence), remove the storage device, and then attach the storage device to a dedicated forensic workstation, using a write blocker. Write blockers are hardware adapters that physically sever the portion of the cable used to connect the storage device that would write data to the device, reducing the likelihood of accidental tampering with the device. After connecting the device to a live workstation, the analyst should immediately calcu- late a cryptographic hash of the device contents and then use forensic tools to create a forensic image of the device: a bitwise copy of the data stored on the device. The analyst should then compute the cryptographic hash of that image to ensure that it is identical to the original media contents.

D https://www.linkedin.com/pulse/forensic-acquisition-methods-investigators-manual-2018-shahul-ahmed

D. Capture a forensic image of the computer.

Correct Answer B: Keyword here is FIRST. Before capture image for forensic, must feed Hash, so that authenticity of evidence confirmed.

taking a forensic image of the computer does not only include the hard drives, it also includes data in RAM. it is a snapshot of the status of the computer. This should be done first.

forensic copy first