IPA IP 2025 Question 74

Collecting and preserving evidence after a computer crime or dispute — digital forensics secures electronic evidence so that it can be used in an investigation or in court.

When a crime, an incident or a legal dispute involving computers occurs, digital forensics collects, analyses and preserves the electronic records involved: restoring deleted files and e-mails, analysing logs, and copying disks in a way that proves nothing was altered, for example by recording hash values of the copies. The aim is evidence that will stand up in court, so every step of the handling is recorded.

Answer (a)

Why not others:

• •(b) — actually attacking a system to find out whether it has vulnerabilities is penetration testing
• •(c) — using a public line as if it were a dedicated line, by encrypting the communication path, is a VPN (Virtual Private Network)
• •(d) — encrypting the hash of a message or file with the sender’s own private key creates a digital signature

Key rule: Forensics is about evidence after the event: collect it, keep it unaltered, and be able to prove that it was not altered.

Security · AI-written, may contain errors