nerdexam
EC-Council

312-49 · Question #223

Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl pac

The correct answer is A. Two. Best practice in computer forensics requires using two separate, independent data acquisition tools when imaging evidence. Using two tools provides cross-validation: if both tools produce identical results (verified via hash values), it confirms the integrity and accuracy of the

Submitted by the_admin· Apr 18, 2026Computer Forensics Investigation Process

Question

Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

Options

  • ATwo
  • BOne
  • CThree
  • DFour

How the community answered

(24 responses)
  • A
    71% (17)
  • B
    8% (2)
  • C
    4% (1)
  • D
    17% (4)

Explanation

Best practice in computer forensics requires using two separate, independent data acquisition tools when imaging evidence. Using two tools provides cross-validation: if both tools produce identical results (verified via hash values), it confirms the integrity and accuracy of the forensic copy. Relying on only one tool leaves no independent verification, while using more than two is unnecessarily redundant and time-consuming.

Topics

#Data acquisition#Forensic tools#Evidence collection#Write-blocker

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice