Legal Aspects of Investigations - Evidence Integrity - CISSP - Security and Risk Management

Описание: ------------------------------------------------------------------------------------------------------
Security and Risk Management: Legal Aspects of Investigations: Evidence Integrity
------------------------------------------------------------------------------------------------------

**I Am NOT An Expert! **

As a method of studying for the CISSP, I am attempting to briefly explain the concepts I am learning in an an effort to help me, and perhaps fellow students.

For an overview of my plan have a look here:    • CISSP - Learning Through Teaching - Introd...  

Please take everything with a grain of salt.If I'm missing something or focusing on the wrong aspect of a concept or term, please post your comment to let me know.
------------------------------------------------------------------------------------------------------------

Legal Aspects of Investigations: Evidence Integrity - Notes

Crucial that the integrity of evidence is maintained, while it is being acquired and analyzed.
Checksums, a comparison of hashes, can ensure that the system has not changed.
o Essentially you take a hash of the system using MD5 or SHA-1
o After you are done analyzing the system you hash the system again compare the hash to the original hash. If they are exact matches your evidence has retained integrity.

Chain of Custody: Another way to show the reliability of evidence is via chain of custody.
Essentially it’s documentation that shows who, what, when and where evidence was handled.
Usually signatures or initials are placed along the way verifying the accuracy of the evidence.
This process supports evidence integrity.