7. An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?
Answer: D
Make a forensic image of the device and create a SHA-1 hash.
Creating a forensic image of the device and generating a SHA-1 hash is the best step to preserve evidence in this situation. This method ensures that a complete and unaltered copy of the data on the laptop is secured for analysis, while the SHA-1 hash allows for verification of the integrity of the data.
A) Disable the user's network account and access to web resources.
Disabling the user's network account and access to web resources is a necessary step to prevent further misuse of the laptop, but it does not preserve the evidence on the device itself. This action does not capture the existing data or prevent potential alterations to the information stored on the laptop.
B) Make a copy of the files as a backup on the server.
Making a copy of the files as a backup on the server is insufficient for preserving evidence because it may not capture all data, including hidden or deleted files. Additionally, transferring files to another location could alter the original data or lead to questions about the authenticity of the evidence.
C) Place a legal hold on the device and the user's network share.
Placing a legal hold on the device and the user's network share is an important step to prevent the destruction or alteration of evidence. However, this action alone does not create a forensic copy of the data, which is crucial for thorough investigation and analysis.
D) Make a forensic image of the device and create a SHA-1 hash.
Creating a forensic image of the device and a SHA-1 hash is the most effective method for preserving evidence. This process captures all data in its current state, including deleted and hidden files, while the hash ensures the integrity of the image, making it a reliable source for investigation.
Conclusion
The process of making a forensic image and creating a SHA-1 hash is the most reliable method for preserving evidence, as it captures all data without alteration and allows for verification of its integrity. Other options may secure the device or data but do not provide the comprehensive evidence preservation needed for a thorough investigation.