A contractor with a different account might have queried the same sensitive records. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Copies already transferred may remain outside the organization's ability to retrieve.

The original database export might be recorded under several service-role aliases. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Copies already transferred may remain outside the organization's ability to retrieve.

Database audit retention may be insufficient to reconstruct older access sessions. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Copies already transferred may remain outside the organization's ability to retrieve.

Shut down the workstation before collecting suspected volatile malware evidence. This option does not establish the stated result with sufficient evidence. Volatile process and network artifacts can disappear when power is removed. The case therefore requires a different action: Capture volatile memory under approved evidence procedure before a shutdown that would destroy it.

Capture only the disk image and assume it includes every memory-only artifact. This option does not establish the stated result with sufficient evidence. Volatile process and network artifacts can disappear when power is removed. The case therefore requires a different action: Capture volatile memory under approved evidence procedure before a shutdown that would destroy it.

Powering off a workstation believed to host memory-only malware can destroy the most probative artifacts. Preserve volatile memory under approved procedure before shutdown when operationally safe.

Volatile memory contents survive normal power-off unchanged on disk. This alternative causal claim assumes facts beyond the observation, which is: A forensic examiner receives a powered-on workstation believed to contain memory-only malware. The directly supported mechanism is: Volatile process and network artifacts can disappear when power is removed.

A full disk image necessarily contains every active process and open socket. This alternative causal claim assumes facts beyond the observation, which is: A forensic examiner receives a powered-on workstation believed to contain memory-only malware. The directly supported mechanism is: Volatile process and network artifacts can disappear when power is removed.

Live memory acquisition leaves running state perfectly unchanged without documentation. This alternative causal claim assumes facts beyond the observation, which is: A forensic examiner receives a powered-on workstation believed to contain memory-only malware. The directly supported mechanism is: Volatile process and network artifacts can disappear when power is removed.

A disk image has a checksum but no volatile process state was preserved. This test or metric does not demonstrate the complete target effect of Capture volatile memory under approved evidence procedure before a shutdown that would destroy it. The decisive observable confirmation is: Recorded acquisition hashes and capture timestamps allow later analysts to verify the preserved image.

The machine is reimaged and evidence of memory-only code disappears. This test or metric does not demonstrate the complete target effect of Capture volatile memory under approved evidence procedure before a shutdown that would destroy it. The decisive observable confirmation is: Recorded acquisition hashes and capture timestamps allow later analysts to verify the preserved image.

An analyst records the hash but not acquisition method or timestamps. This test or metric does not demonstrate the complete target effect of Capture volatile memory under approved evidence procedure before a shutdown that would destroy it. The decisive observable confirmation is: Recorded acquisition hashes and capture timestamps allow later analysts to verify the preserved image.

An authorized incident response tool could be mistaken for attacker-created memory activity. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Memory imaging itself changes system state, so acquisition effects must be documented.

An encrypted memory region could remain unreadable to the chosen collection method. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Memory imaging itself changes system state, so acquisition effects must be documented.

The analyst may not have captured the system's network state at exactly the same instant. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Memory imaging itself changes system state, so acquisition effects must be documented.

Continue transferring the USB and image without recording custody after a verbal handoff. This option does not establish the stated result with sufficient evidence. Without traceable transfers and integrity verification, investigators cannot confidently demonstrate evidence provenance. The case therefore requires a different action: Establish documented custody, unique evidence identifiers and integrity hashing before further examination.

Use only filename and case number to prove digital evidence integrity. This option does not establish the stated result with sufficient evidence. Without traceable transfers and integrity verification, investigators cannot confidently demonstrate evidence provenance. The case therefore requires a different action: Establish documented custody, unique evidence identifiers and integrity hashing before further examination.

Discard the original device after making one unverified copy. This option does not establish the stated result with sufficient evidence. Without traceable transfers and integrity verification, investigators cannot confidently demonstrate evidence provenance. The case therefore requires a different action: Establish documented custody, unique evidence identifiers and integrity hashing before further examination.

A consistent file name is enough to prove the evidence never changed between teams. This alternative causal claim assumes facts beyond the observation, which is: A security incident case includes a USB device and disk image, but evidence has been passed between teams with no transfer record. The directly supported mechanism is: Without traceable transfers and integrity verification, investigators cannot confidently demonstrate evidence provenance.

An investigator's job title automatically establishes every undocumented custody transfer. This alternative causal claim assumes facts beyond the observation, which is: A security incident case includes a USB device and disk image, but evidence has been passed between teams with no transfer record. The directly supported mechanism is: Without traceable transfers and integrity verification, investigators cannot confidently demonstrate evidence provenance.

An image copied once can be presumed byte-identical without hashing. This alternative causal claim assumes facts beyond the observation, which is: A security incident case includes a USB device and disk image, but evidence has been passed between teams with no transfer record. The directly supported mechanism is: Without traceable transfers and integrity verification, investigators cannot confidently demonstrate evidence provenance.

An image is readable but no independent digest or handoff record exists. This test or metric does not demonstrate the complete target effect of Establish documented custody, unique evidence identifiers and integrity hashing before further examination. The decisive observable confirmation is: Every custody handoff and image digest is independently reproducible from the sealed evidence record.

The current custodian signs a form without identifying previous holders. This test or metric does not demonstrate the complete target effect of Establish documented custody, unique evidence identifiers and integrity hashing before further examination. The decisive observable confirmation is: Every custody handoff and image digest is independently reproducible from the sealed evidence record.

The file size matches a reference while its cryptographic hash has not been checked. This test or metric does not demonstrate the complete target effect of Establish documented custody, unique evidence identifiers and integrity hashing before further examination. The decisive observable confirmation is: Every custody handoff and image digest is independently reproducible from the sealed evidence record.

The underlying file-system creation time could have changed during a legitimate copy. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Earlier undocumented handling remains a limitation even after proper custody begins.

A controlled duplicate disk image might require a new hash manifest for an authorized analyst. This concerns an adjacent administrative, operational or conditional risk, not the particular continuing weakness supported most directly by A security incident case includes a USB device and disk image, but evidence has been passed between teams with no transfer record. The specific case-derived residual is: Earlier undocumented handling remains a limitation even after proper custody begins.

The legal review may still question continuity despite a new signed custody record. This is a conceivable secondary or conditional concern, but is not the residual exposure most directly tied to the scenario and its chosen response. Earlier undocumented handling remains a limitation even after proper custody begins.

Delete all suspected phishing messages before preserving headers and mailbox audit records. This option does not establish the stated result with sufficient evidence. Destroying potential evidence before capture can undermine scope analysis, recovery and legal obligations. The case therefore requires a different action: Preserve relevant messages and headers under legal and response requirements before targeted removal or quarantine.

Publish a public warning with unverified details before legal review and retention. This option does not establish the stated result with sufficient evidence. Destroying potential evidence before capture can undermine scope analysis, recovery and legal obligations. The case therefore requires a different action: Preserve relevant messages and headers under legal and response requirements before targeted removal or quarantine.

Quarantine one message and close the incident without determining all recipients and forwards. This option does not establish the stated result with sufficient evidence. Destroying potential evidence before capture can undermine scope analysis, recovery and legal obligations. The case therefore requires a different action: Preserve relevant messages and headers under legal and response requirements before targeted removal or quarantine.

Message deletion is always safer than retaining forensic copies in a controlled repository. This alternative causal claim assumes facts beyond the observation, which is: During a suspected business-email compromise, finance requests immediate deletion of every related mailbox message before collection. The directly supported mechanism is: Destroying potential evidence before capture can undermine scope analysis, recovery and legal obligations.

A suspected email compromise has no legal preservation or chain-of-evidence implications. This alternative causal claim assumes facts beyond the observation, which is: During a suspected business-email compromise, finance requests immediate deletion of every related mailbox message before collection. The directly supported mechanism is: Destroying potential evidence before capture can undermine scope analysis, recovery and legal obligations.

Quarantining one mailbox item proves no other recipients or forwarded copies exist. This alternative causal claim assumes facts beyond the observation, which is: During a suspected business-email compromise, finance requests immediate deletion of every related mailbox message before collection. The directly supported mechanism is: Destroying potential evidence before capture can undermine scope analysis, recovery and legal obligations.