312-49V11 · Question #114
Jane is a forensic investigator at a top cybersecurity firm. While analyzing a suspect's computer for evidence related to a potential data breach, she came across a log file that appeared to have…
The correct answer is B. She should make a bit-stream image copy of the hard drive. The first priority in any digital forensic investigation is evidence preservation. Creating a bit- stream (forensic) image of the hard drive captures an exact sector-by-sector copy of the entire storage media, including active data, deleted data, slack space, and unallocated…
Question
Jane is a forensic investigator at a top cybersecurity firm. While analyzing a suspect's computer for evidence related to a potential data breach, she came across a log file that appeared to have been tampered with. The timestamp of the file seems modified, and some parts of the file seem to have been deliberately deleted. What should Jane do first to ensure the preservation and authenticity of the digital evidence?
Options
- AShe should try to recover the deleted parts of the log file
- BShe should make a bit-stream image copy of the hard drive
- CShe should continue her analysis, taking note of the tampering
- DShe should immediately contact her supervisor and present the altered log file
How the community answered
(51 responses)- A8% (4)
- B71% (36)
- C4% (2)
- D18% (9)
Explanation
The first priority in any digital forensic investigation is evidence preservation. Creating a bit- stream (forensic) image of the hard drive captures an exact sector-by-sector copy of the entire storage media, including active data, deleted data, slack space, and unallocated space.
Topics
Community Discussion
No community discussion yet for this question.