A Security Incident May Have Occurred on the Desktop PC

question 58

Multiple Choice

A security incident may have occurred on the desktop PC of an organization's Chief Executive Officer (CEO) . A duplicate copy of the CEO's hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?

• A) Install a new hard drive in the CEO's PC, and then remove the old hard drive and place it in a tamper-evident bag.
• B) Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy. Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy.
• C) Remove the CEO's hard drive from the PC, connect to the forensic workstation, and copy all the contents onto a remote fileshare while the CEO watches.
• D) Refrain from completing a forensic analysis of the CEO's hard drive until after the incident is confirmed; duplicating the hard drive at this stage could destroy evidence.

---

Definitions:

Phishing Scams

Fraudulent attempts to obtain sensitive information, such as usernames, passwords, and credit card details, by disguising as a trustworthy entity in an electronic communication.

Black-Hat Hacker

A hacker who uses his or her knowledge to destroy information or for illegal gain.

Denatured

Loss of a protein’s or enzyme’s normal shape so that it no longer functions; usually caused by a less than optimal pH and temperature.