Under no circumstances should anyone, with the exception of qualified computer forensics personnel, make any attempts to restore or recover information from a computer system or device that holds…

The correct answer is A. True. True. Only qualified computer forensics personnel should attempt to restore or recover information from a device holding electronic evidence. Untrained attempts can alter metadata, overwrite deleted data, destroy artifacts, or break the chain of custody - all of which can…

Submitted by tarun92· Apr 18, 2026Computer Forensics in Today's World

Question

Under no circumstances should anyone, with the exception of qualified computer forensics personnel, make any attempts to restore or recover information from a computer system or device that holds electronic information.

Options

ATrue
BFalse

How the community answered

(32 responses)

A
88% (28)
B
13% (4)

Explanation

True. Only qualified computer forensics personnel should attempt to restore or recover information from a device holding electronic evidence. Untrained attempts can alter metadata, overwrite deleted data, destroy artifacts, or break the chain of custody - all of which can render evidence inadmissible in court. Proper forensic procedures ensure evidence integrity and legal defensibility.

Topics

#Evidence preservation#Data recovery#Forensics best practices#Qualified personnel

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice