A security analyst gathered forensics from a recent intrusion in preparation for legal proceedings. The analyst used EnCase to gather the digital forensics, cloned the hard drive, and took the hard drive home for further analysis. Which of the following did the security analyst violate?
A) Cloning procedures
B) Chain of custody
C) Hashing procedures
D) Virtualization

Question

Quizplus · Accepted Answer

The security analyst violated the chain of custody by taking the hard drive home for further analysis. The chain of custody is a record of who has had possession of evidence and when, and it is important to maintain the chain of custody to ensure the integrity of the evidence.

A Security Analyst Gathered Forensics from a Recent Intrusion in Preparation