312-49V11 · Question #119
A Computer Hacking Forensics Investigator (CHFI) has been called in to handle a complex data breach at a large corporation. The investigator plans to follow the rules of thumb for data acquisition…
The correct answer is C. Performing the forensic investigation directly on the original evidence. Best practice is to preserve the original evidence in an unchanged state and conduct analysis on verified forensic duplicates. Working directly on the original can alter timestamps, metadata, and content, jeopardizing integrity and admissibility. Creating multiple images and…
Question
A Computer Hacking Forensics Investigator (CHFI) has been called in to handle a complex data breach at a large corporation. The investigator plans to follow the rules of thumb for data acquisition during the investigation. Which of the following actions is NOT in line with these best practices?
Options
- AProducing two copies of the original media before starting the investigation process
- BVerifying the integrity of the duplicates by comparing them to the original using hash values
- CPerforming the forensic investigation directly on the original evidence
- DCreating a duplicate bit-stream image of the suspicious drive for analysis
How the community answered
(23 responses)- A4% (1)
- B9% (2)
- C83% (19)
- D4% (1)
Explanation
Best practice is to preserve the original evidence in an unchanged state and conduct analysis on verified forensic duplicates. Working directly on the original can alter timestamps, metadata, and content, jeopardizing integrity and admissibility. Creating multiple images and verifying them with hashes (A, B, D) aligns with standard forensic procedure.
Topics
Community Discussion
No community discussion yet for this question.