Before data acquisition, media must be sanitized to erase previous information. Industry standards dictate data destruction methods based on sensitivity levels. Investigators follow standards like…

Question

Options

• AOverwriting the data on the target media
• BRecycling the target media
• CFormatting the target media
• DIgnoring data sanitization

• A
  80% (20)
• B
  4% (1)
• C
  12% (3)
• D
  4% (1)

Explanation

This question aligns with CHFI v11 objectives under Data Acquisition and Duplication, specifically media preparation and data sanitization standards. Before using any storage media for forensic acquisition, investigators must ensure that it does not contain residual data that could contaminate evidence or cause data leakage. CHFI v11 stresses that data sanitization is mandatory prior to acquisition to maintain confidentiality, integrity, and forensic soundness. According to standards such as NIST SP 800-88, DoD, NAVSO, and VSITR, simply formatting a disk is insufficient because formatting only removes file system references while leaving underlying data intact and potentially recoverable. Recycling media without sanitization poses severe security risks, and ignoring sanitization violates forensic and legal best practices. Overwriting the target media--also known as data wiping--is a recognized and approved sanitization method. It replaces existing data with predefined patterns (e.g., zeros, ones, or random data), ensuring previous information cannot be recovered. CHFI v11 highlights overwriting as a logical sanitization technique suitable when physical destruction is not required. Therefore, consistent with CHFI v11 and industry standards, overwriting the data on the target media is the crucial step to ensure data security before forensic data acquisition.

No community discussion yet for this question.