To preserve digital evidence, an investigator should ____________

The correct answer is C. Make two copies of each evidence item using different imaging tools. Best practice in digital forensics requires making two forensic copies (images) of each piece of evidence using two different approved imaging tools. This approach serves multiple purposes: it ensures redundancy in case one copy is corrupted or challenged; it provides…

Submitted by thandi_sa· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AMake two copies of each evidence item using a single imaging tool
BMake a single copy of each evidence item using an approved imaging tool
CMake two copies of each evidence item using different imaging tools
DOnly store the original evidence item

How the community answered

(66 responses)

A
3% (2)
B
2% (1)
C
95% (63)

Explanation

Best practice in digital forensics requires making two forensic copies (images) of each piece of evidence using two different approved imaging tools. This approach serves multiple purposes: it ensures redundancy in case one copy is corrupted or challenged; it provides verification that both tools produce identical results (confirmed by matching hash values such as MD5 or SHA-256); and it protects against tool-specific bugs or errors. Using a single tool for both copies (option A) provides redundancy but not tool-independent verification. A single copy (option B) provides no backup. Storing only the original (option D) risks evidence contamination and violates the principle of working only from copies.

Topics

#Digital Evidence Preservation#Forensic Imaging#Evidence Integrity#Best Practices

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice