Question

During a ransomware investigation, an analyst images an infected workstation's hard drive and stores the image on an evidence server. Legal has indicated the case may result in prosecution of an insider. Which action is MOST important to ensure the disk image will be admissible in court?

Accepted Answer

Document a chain-of-custody log recording every person who handled the image, along with dates, times, and purpose of access

Answer

Encrypt the disk image with AES-256 before transferring it to the evidence server

Answer

Immediately reimage the affected workstation so it can return to production

Answer

Compress the image to reduce storage requirements on the evidence server