Question

1. List the steps in maintaining chain of custody for digital evidence.
2. Why is it important to follow the chain of custody when gathering evidence?
3. For the computer forensics case, identify what evidence the forensics experts were able to gather.
4. Name two of the things the United States attorney was able to prove in the computer forensics case.
5. What important questions should the security incident response form answer.
6. Why is it important to include a time/date stamp in the security incident response form?

Answer 1

List the steps in maintaining chain of custody for digital evidence.

Information Collection: This is the place chain of authority measure is started. It includes distinguishing proof, naming, recording, and the securing of information from all the conceivable pertinent sources that save the uprightness of the information and proof gathered.

Assessment: During this cycle, the chain of care data is recorded illustrating the legal cycle embraced. It is essential to catch screen captures all through the cycle to show the assignments that are finished and the proof revealed.

Investigation: This stage is the aftereffect of the assessment stage. In the Analysis stage, lawfully reasonable strategies and methods are utilized to determine helpful data to address addresses presented in the specific case.

Revealing: This is the documentation period of the Examination and Analysis stage. Revealing incorporates the accompanying:

Proclamation with respect to Chain of Custody.

Clarification of the different instruments utilized.

A portrayal of the investigation of different information sources.

Issues recognized.

Weaknesses recognized.

Suggestion for extra crime scene investigation gauges that can be taken.

Why is it important to follow the chain of custody when gathering evidence?

It is imperative to keep up the chain of authority to safeguard the trustworthiness of the proof and keep it from defilement, which can adjust the condition of the proof. If not protected, the proof introduced in court may be tested and administered prohibited.

Name two of the things the United States attorney was able to prove in the computer forensics case.

• The distributor was purchasing drugs from foreign sources to be sold within the United States.
• The distributor was operating unlicensed pharmacies and nursing homes.