With regard to using an antivirus scanner during a computer forensics investigation, you should:

The correct answer is D. Scan your forensics workstation before beginning an investigation. The forensics workstation itself must be verified to be clean and uninfected before beginning any investigation. If the workstation has malware, it could contaminate evidence, alter results, or compromise the integrity of the investigation. You should never scan the suspect's…

Submitted by devops_kid· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AScan the suspect hard drive before beginning an investigation
BNever run a scan on your forensics workstation because it could change your system
CScan your forensics workstation at intervals of no more than once every five minutes during an
DScan your forensics workstation before beginning an investigation

How the community answered

(28 responses)

A
4% (1)
B
7% (2)
C
4% (1)
D
86% (24)

Explanation

The forensics workstation itself must be verified to be clean and uninfected before beginning any investigation. If the workstation has malware, it could contaminate evidence, alter results, or compromise the integrity of the investigation. You should never scan the suspect's original evidence drive directly (always work from a forensic copy), and scanning at five-minute intervals during an investigation is impractical and unnecessary. Pre-investigation scanning of your own workstation is a best practice to ensure a clean, trustworthy examination environment.

Topics

#Antivirus scanning#Forensics workstation preparation#Investigation best practices#Evidence integrity

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice