312-49 · Question #213
What must an investigator do before disconnecting an iPod from any type of computer?
The correct answer is A. Unmount the iPod. Before physically disconnecting any removable storage device-including an iPod-a forensic investigator must unmount (eject) it from the operating system first. Unmounting ensures that all pending write operations are flushed to disk and that the file system is left in a…
Question
What must an investigator do before disconnecting an iPod from any type of computer?
Options
- AUnmount the iPod
- BMount the iPod
- CDisjoin the iPod
- DJoin the iPod
How the community answered
(59 responses)- A86% (51)
- B3% (2)
- C2% (1)
- D8% (5)
Explanation
Before physically disconnecting any removable storage device-including an iPod-a forensic investigator must unmount (eject) it from the operating system first. Unmounting ensures that all pending write operations are flushed to disk and that the file system is left in a consistent state. Disconnecting without unmounting can cause file system corruption, alter metadata (timestamps), or destroy evidence, which would compromise the integrity of the forensic investigation. 'Mount' means making the device accessible to the OS, while 'unmount' safely releases it. 'Disjoin' and 'join' are not standard terms in this context.
Topics
Community Discussion
No community discussion yet for this question.