Preserving Evidence for Suspected Misuse Investigation

CS0-003 By islever Editorial Last updated

Given a scenario, perform incident response activities

Short answer

D Make a forensic image of the device and create a SHA-1 hash.

Question

An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?
  1. Disable the user’s network account and access to web resources.
  2. Make a copy of the files as a backup on the server.
  3. Place a legal hold on the device and the user’s network share.
  4. Make a forensic image of the device and create a SHA-1 hash. Correct Answer

Key Takeaways

The exam tests the distinction between administrative containment (legal hold) and technical preservation (forensic imaging). The common trap is selecting legal hold, which prevents future changes but does not preserve the current state of volatile or altered data on the device.

This question addresses the critical step of preserving digital evidence during an internal HR investigation. It establishes that creating a forensic image with a hash is the only method that guarantees data integrity and admissibility.

Common mistake: Option C is the most common wrong answer because 'legal hold' sounds like a protective measure. However, it fails to capture the existing evidence on the hard drive, which may have already been modified by the user before suspension.

Expert Analysis

Why the Answer Is Correct

Creating a forensic image of the device ensures that every bit of data, including deleted files and unallocated space, is captured exactly as it exists at that moment. Generating a SHA-1 hash provides a cryptographic fingerprint of the image, allowing investigators to verify later that the evidence has not been tampered with. This process satisfies the chain of custody requirements essential for any formal investigation.

Why the Other Options Are Wrong

Disabling the account (A) stops further activity but does not preserve what is already on the laptop. Copying files (B) is insufficient because it misses system artifacts, registry hives, and deleted data, and lacks integrity verification. A legal hold (C) prevents new data from being written or old data from being deleted in the future, but it does not create a snapshot of the current state of the device, which is the primary goal when preserving evidence of past misuse.

Community Comment Notes

The community overwhelmingly supports D. As one commenter noted, "Focus on the question" regarding the need to preserve the device's state rather than just preventing future access. Another highlighted that while SHA-1 is deprecated, it is still valid for verifying the integrity of a static forensic image copy in this context, whereas other options fail to provide any integrity check.

Exam Strategy

Always distinguish between 'preventing future change' and 'preserving current state.' If the question asks to preserve evidence, look for imaging and hashing. If it asks to prevent further damage or data loss, look for isolation or legal holds.

Frequently Asked Questions

Why is legal hold not the best step to preserve evidence?

Legal hold prevents deletion or modification going forward but does not capture the current state of the device, including deleted files or volatile data.

Is SHA-1 still acceptable for forensic hashing?

While SHA-1 is deprecated for security cryptography, it is still widely accepted in forensics for verifying the integrity of a copied image against the original.

More CS0-003 FAQ →

Discussion 26 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 26

  1. b0ad9e1 👍 16 Answered D
    Read the question, "An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?" The focus is the laptop. We need to image it and hash the image. The answer cant be legal hold as there is not regulatory or legal invoked. It says he misused the laptop, no detail was given to how it was misused. There are a number of things he could have been doing which would have been against company policy, but would not have triggered a legal hold. There is nothing to indicate there is potential litigation pending.
  2. section8santa 👍 8 Answered D
    This approach ensures that a complete and exact copy of all the data on the device is made, which is essential for a forensic investigation. The SHA-1 hash is used to verify the integrity of the data, ensuring that the forensic image is an exact, unaltered copy of the original data. This is critical for legal and investigative purposes, as it ensures the admissibility of the evidence in any potential legal proceedings.
  3. throughthefray 👍 4 Answered D
    NIST recommended SHA-1 should be phased out by Dec. 31, 2030 as far as I know this question doesnt mention taking place in the future. SHA-1 would be a problem here if there was a hashed password that they were trying to secure. There isnt one, so thats not even the problem being addressed here. Also what if the user has a logic bomb that says "if i dont log in to my network share account in X amount of time, just wipe my account." Now while the law is creeping slowly toward a resolution that account is being wiped. I argue that one should forensically copy that persons device and their storage on the network share drive hash it. Im gonna argue for D on this one, however im open to the wisdom/counter arguments of others.
  4. throughthefray 👍 4
    Also... The question asks for BEST solution not for the FIRST step. Hear me out. Sure sha1 was deprecated... but it was done so because of the expected ease of AI having the ability to crack/ brute force it, which wouldnt be a problem here as their goal here is to ensure that evidence is preserved, which having a hash of the drive that was copied would allow you to know. That drive and hash would be in the possession of the forensic analyst within a forensic environment. There would be no realistic risk of that hash being brute forced.
  5. 581777a 👍 4 Answered D
    The answer is D because C does not preserve evidence which is what the question is asking. Sometimes you have to look for those keywords because there will usually be two or good answers.
Show 21 more comments
  1. RT7 👍 4
    Hi 581777a- Just wondering if your test had most of the questions listed in here?
  2. maggie22 👍 4 Answered D
    Forensic imaging. Do not focus on the laptop. Focus on the question.
  3. muvisan 👍 3 Answered C
    To my understanding answer C Legal Hold is the right answer here... A legal hold is the process by which an organization advises personnel when information must be preserved for potential litigation matters or investigations. Answer D - forensic image, would be for preserving an infected server... which is not the case here.
  4. kmordalv 👍 3 Answered D
    Correct. Creating a forensic image of the company-issued laptop ensures that an exact copy of the device's data, files, and settings is preserved in a forensically sound manner. This ensures that the original data remains intact and unaltered, which is crucial for any potential investigation or legal proceedings.
  5. _invalid_nickname 👍 3 Answered D
    Question is not asking for first step nor gave any details into the nature of the misuse. It just what asked is the step to preserve evidence. The only step that guarantees the evidence is preserved and not tampered with is D (one can check for tampering with hashes, even if it is an outdated one).
  6. Mehe323 👍 3 Answered D
    The SHA-1 part is weird, but C can not actually stop a user from making changes until the laptop is seized, so that is why I chose D.
  7. 89b45b4 👍 3 Answered D
    It only says "best step to preserve evidence" which means make a forensic image.
  8. captaintoadyo 👍 3 Answered C
    Sha1 is very old is not advised to be used as it is very insecure...
  9. LiveLaughToasterBath 👍 3 Answered C
    SHA-1 was deprecated for use by NIST.
  10. luiiizsoares 👍 2 Answered D
    Correct Answer: D. Analysis: Making a forensic image of the device and creating a SHA-1 hash is the best step to preserve evidence. This process ensures that a bit-by-bit copy of the device is taken, preserving the original state of the data for future analysis and investigation. The SHA-1 hash provides a cryptographic verification that the copy is identical to the original, which is crucial for maintaining the integrity of the evidence.
  11. mmsbaseball3 👍 2 Answered D
    Even with SHA-1 being old this is the best answer available. There would be no reason to put a legal hold on the laptop as it is the property of the company and would be returned or confiscated anyways. A legal hold would make more sense if it mentioned they had a BYOD policy and the user was using their' own laptop.
  12. Anonymous learner 👍 2 Answered D
    I'm going with D since C is an administrative process, and not an actual technical process of preserving evidence. The Legal Hold is simply an order, but it does nothing to preserve the data.
  13. 581777a 👍 2
    I appreciate the insight, it makes sense then. I have my test in the morning so I hope it's right lol
  14. Kmelaun 👍 1 Answered C
    C. Place a legal hold on the device and the user’s network share. CertMaster Topic 8B: A legal hold, or litigation hold, describes the notification received by an organization's legal team instructing them to preserve electronically stored information (ESI) and/or paper documents that may be relevant to a pending legal case. Legal hold authority can be complicated by jurisdiction, but these details are managed by legal teams. It is imperative that the cybersecurity team be notified of legal holds as soon as possible in order to ensure data is preserved in accordance with the order. Legal hold requirements often exceed the data protection and retention periods ordinarily in place.
  15. Berro_b 👍 1 Answered D
    The key clue is "Best step to preserve evidence." The analyst needs to preserve the laptop's data and verify that it has not been modified. - Forensic image → Creates a bit-for-bit copy of the hard drive, including deleted-file remnants and metadata. - SHA-1 hash → Creates a digital fingerprint to help verify evidence integrity.
  16. kmordalv 👍 1
    Muvisan, a forensic copy is not only used on an infected server. It is used to make a backup copy to ensure that it is not modified for legal action. Given that it is pending an investigation by HR I think your answer is correct.
  17. muvisan 👍 1
    still I think C is correct - as Legal hold triggers that processes are started to preserve data - see comptia study guide, chapter 10, evidence acquisition and preservation.
  18. Aziz132 👍 1
    since they mentioned that the employee was suspended. They are indicating that he will no longer be using his machine until the investigation is done. C sounds about right.
  19. yeahnodontthinkso 👍 1
    I see where you're coming from but there's nothing to indicate that the employee did anything illegal. They simply broke company policy.
  20. deeden 👍 1 Answered C
    It appears this question is similar to whether to: A. secure the crime scene; or B. start collecting evidence. Most people choose A.
  21. Anonymous learner 👍 1 Answered C
    Came back to this one. SHA-1 was indeed deprecated last year (2022). C is the best option since D can be eliminated.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide