312-49 · Question #413
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the…
The correct answer is C. A simple DOS copy will not include deleted files, file slack and other information. A standard OS-level file copy (like DOS COPY) only copies visible, allocated files. It misses deleted files (still present in unallocated clusters), file slack space (unused space at the end of file clusters), the MBR, swap files, and other forensically significant data. A…
Question
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?
Options
- AA disk imaging tool would check for CRC32s for internal self checking and validation and have
- BEvidence file format will contain case data entered by the examiner and encrypted at the
- CA simple DOS copy will not include deleted files, file slack and other information
- DThere is no case for an imaging tool as it will use a closed, proprietary format that if compared to
How the community answered
(45 responses)- A4% (2)
- B2% (1)
- C93% (42)
Explanation
A standard OS-level file copy (like DOS COPY) only copies visible, allocated files. It misses deleted files (still present in unallocated clusters), file slack space (unused space at the end of file clusters), the MBR, swap files, and other forensically significant data. A proper disk imaging tool creates a bit-for-bit clone of the entire physical disk, preserving all of this data. This is critical for a complete and legally defensible forensic investigation.
Topics
Community Discussion
No community discussion yet for this question.