220-1102 · Question #279
Which of the following options should MOST likely be considered when preserving data from a hard drive for forensic analysis? (Choose two.)
The correct answer is B. Chain of custody. Note: The question instructs 'Choose two,' so the complete correct answer is B and D. Chain of custody (B) documents every person who handled the evidence from collection through court presentation - without it, evidence can be challenged as tampered or contaminated. Data integri
Question
Which of the following options should MOST likely be considered when preserving data from a hard drive for forensic analysis? (Choose two.)
Options
- ALicensing agreements
- BChain of custody
- CIncident management documentation
- DData integrity
- EMaterial safety data sheet
- FRetention requirements
How the community answered
(25 responses)- B96% (24)
- D4% (1)
Explanation
Note: The question instructs 'Choose two,' so the complete correct answer is B and D. Chain of custody (B) documents every person who handled the evidence from collection through court presentation - without it, evidence can be challenged as tampered or contaminated. Data integrity (D) ensures the forensic copy is bit-for-bit identical to the original (verified via hashing algorithms like MD5 or SHA-256) so that evidence has not been altered. Licensing agreements (A), material safety data sheets (E), and retention requirements (F) are not primary forensic preservation concerns. Incident management documentation (C) is useful broadly but is not a forensic-specific preservation requirement.
Topics
Community Discussion
No community discussion yet for this question.