You should always work with original evidence

The correct answer is B. False. This statement is FALSE. A core principle of digital forensics is to NEVER work with original evidence. Instead, forensic investigators must create a verified bit-for-bit forensic copy (image) of the original media and conduct all analysis on that copy. Working directly on…

Submitted by fatema_kw· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ATrue
BFalse

How the community answered

(22 responses)

A
9% (2)
B
91% (20)

Explanation

This statement is FALSE. A core principle of digital forensics is to NEVER work with original evidence. Instead, forensic investigators must create a verified bit-for-bit forensic copy (image) of the original media and conduct all analysis on that copy. Working directly on original evidence risks altering, corrupting, or destroying data, which would compromise the integrity of the evidence and its admissibility in court. Preserving the original unaltered evidence is essential for maintaining chain of custody and evidentiary integrity.

Topics

#Evidence handling#Preservation of evidence#Forensic principles#Forensic imaging

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice