A security incident occurs that requires a systems administrator to take an image of a user's workstation hard drive.
Which of the following should be taken at the time the system image is generated and retained through the file of the investigation to assure files have not been modified since?
Click on the arrows to vote for the correct answer
A. B. C. D.A.
When an organization experiences a security incident, one of the actions a systems administrator may take is to take an image of the user's workstation hard drive. This image can be used as evidence during an investigation to determine what happened and who was responsible for the incident. However, to ensure the integrity of the evidence, it is important to take certain steps to prevent any modifications to the files.
One way to ensure the integrity of the evidence is to generate a checksum hash of the drive image or files at the time the system image is taken. A checksum is a unique value that is generated from the contents of a file or disk. If any changes are made to the file or disk, the checksum will also change. By comparing the checksum generated at the time the image was taken to the checksum generated later, the systems administrator can verify that the files have not been modified.
Option B, copies of the system logs at specific intervals, may be useful for investigating the security incident but does not directly ensure the integrity of the system image. Similarly, option C, a snapshot of the file system, may be useful for investigating the security incident but does not directly ensure the integrity of the system image.
Option D, the user's credentials and permissions, is not relevant to ensuring the integrity of the system image. User credentials and permissions are used to control access to the system, but they do not directly impact the integrity of the system image.
Therefore, the best option is A, a checksum hash of the drive image or files. This will provide assurance that the files have not been modified since the system image was generated and will help ensure the integrity of the evidence during the investigation.