EC-Council
312-49V11 · Question #115
312-49V11 Question #115: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49V11 to reveal the answer and full explanation for question #115. The question stem and answer options stay visible for context.
Question
A cybersecurity forensics investigator is tasked with acquiring data from a suspect's drive for a civil litigation case. The suspect drive is 1TB, and due to time constraints, the investigator decides to prioritize and acquire only data of evidentiary value. The original drive cannot be retained. In this context, which of the following steps should the investigator prioritize?
Options
- AOpt for disk-to-image copying for the large suspect drive
- BExecute logical acquisition considering the one-time opportunity to capture data
- CUtilize DriveSpace or DoubleSpace to reduce the data size
- DUse a reliable data acquisition tool to make a copy of the original drive
Unlock 312-49V11 to see the answer
You've previewed enough free 312-49V11 questions. Unlock 312-49V11 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.