Most of Domain 4 rewards the same instinct. See the alert. Find the cause. Shut the bad thing down. Then you reach the forensics questions and that instinct starts costing you points.
Once an incident is confirmed and you are collecting evidence, the exam changes what it wants. It stops asking how you catch the attacker. It starts asking whether anything you did will hold up later. And the trap answers are the ones that feel the most productive. Reboot the machine. Run antivirus on it. Copy the files off to look at them. Every one of those quietly damages the thing you are supposed to protect.
Here is the single question that sorts almost every forensics item. Does this preserve the evidence exactly as it was, and can I prove it? Two halves. Preserve it. Prove it. Keep those in your head and the answer choices start sorting themselves.
Chain of custody is the answer people skip
If you memorize one forensics term, make it this one.
Chain of custody is the documented record of who handled a piece of evidence and when, from the moment it is collected to the moment it shows up in court. Every handoff gets logged. Nothing sits unaccounted for.
Why does the exam love it so much? Because a single gap is enough for a defense lawyer to argue the evidence could have been altered while nobody was watching. Once that doubt exists, the whole thing can be thrown out. All that technical work gone to waste, because the paperwork had a hole in it.
So when a stem asks what maintains the integrity of evidence, or what keeps it admissible, or what you should be documenting through the whole process, the answer is chain of custody far more often than not.
Acquire it without touching the original
The second cluster of questions is about collecting the data the right way, and there is a small toolkit here that shows up again and again.
You never work from the original. You make a bit-for-bit image and work from the copy. A write blocker sits between you and the source drive so the act of imaging cannot write anything back to it. Then you hash the image when you take it, and hash it again later. If the two values match, you have proof the data did not change while it was in your hands.
That last step is the whole point. The hash is how you prove preservation instead of just claiming it.
So what does that quietly rule out? Opening a file to peek at it changes timestamps. Booting the machine writes to the disk. Running antivirus modifies things. On a forensics question, any option that reads or runs from the original is usually the wrong one, however reasonable it sounds.
You do grab the most fragile data first, since memory and live network connections vanish the second you pull the power. Just do not let that one detail pull your focus off the real theme, which is proving nothing was tampered with.
Legal hold and e-discovery
Two more terms trip people up because they sound like lawyer words rather than security ones.
A legal hold is the trigger that says stop deleting. When an organization reasonably expects litigation, it has to suspend its normal deletion and retention routines for anything relevant, so evidence is not quietly erased by an auto-delete policy. The exam tell here is a retention schedule or an automatic cleanup that is about to wipe something a case might need. You preserve it under legal hold rather than let the schedule run.
E-discovery is the legal process of collecting electronically stored information and producing it for a case. Think of forensics as the technical handling of the evidence and e-discovery as the formal legal request to hand it over. Same data, different job.
A quick decoder
Read the scenario, then ask what it is really testing.
"Which step maintains the integrity of collected evidence?" That is chain of custody.
"An analyst needs to examine a suspect drive." Image it behind a write blocker and hash it. Work only from the copy.
"A retention policy will delete logs relevant to a pending lawsuit." Legal hold.
"Prove the evidence file was not modified after collection." Compare the hash taken at acquisition against the current one.
The drill that makes this stick is simple. For any forensics stem, ask the two-part question out loud. Did this preserve the original, and can I prove it? Then cross off every option that touches the original or skips the documentation. What is left is almost always the key.
If you want to pressure test that on real exam-style scenarios, that is exactly what I built SecPlus Mastery around, and the free diagnostic will tell you fast whether the forensics questions are a weak spot before exam day does.
Top comments (0)