Data files from original evidence should be used for forensics analysis

The correct answer is B. False. A core principle of digital forensics is to never work directly on the original evidence. Forensic investigators must create a bit-for-bit forensic image (clone) of the original media and perform all analysis on that copy. Working on originals risks altering metadata…

Submitted by khalil_dz· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ATrue
BFalse

How the community answered

(35 responses)

A
9% (3)
B
91% (32)

Explanation

A core principle of digital forensics is to never work directly on the original evidence. Forensic investigators must create a bit-for-bit forensic image (clone) of the original media and perform all analysis on that copy. Working on originals risks altering metadata, timestamps, or file content, which can compromise the integrity of the evidence and render it inadmissible in court. The original must be preserved, write-protected, and stored securely with a documented chain of custody.

Topics

#Evidence handling#Forensic integrity#Original evidence#Data preservation

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice