312-49V11 · Question #32
An investigator is working on a digital forensics case involving a suspected data breach. The investigator is tasked with acquiring data from the suspect's hard drive. Before beginning the data…
The correct answer is D. Sanitize the target media to make the content unrecoverable. According to the CHFI v11 Data Acquisition Concepts and Rules, sanitizing the target media is a critical preparatory step performed before acquiring forensic data, especially when reusing storage media or handling sensitive information. Sanitization refers to the process of…
Question
An investigator is working on a digital forensics case involving a suspected data breach. The investigator is tasked with acquiring data from the suspect's hard drive. Before beginning the data extraction process, the investigator securely removes all sensitive data from the drive. To ensure that no residual data can be recovered from the drive, the investigator applies a method to overwrite the data on the drive using a series of sequential zeros and ones, thereby protecting the privacy and integrity of the investigation. Which forensic data acquisition step is the investigator performing?
Options
- AValidating data acquisition to ensure complete and accurate data collection.
- BAcquiring volatile data to capture temporary, live data from the system.
- CPlanning for contingency to ensure backup procedures are in place in case of failure.
- DSanitize the target media to make the content unrecoverable.
How the community answered
(23 responses)- A17% (4)
- B4% (1)
- C9% (2)
- D70% (16)
Explanation
According to the CHFI v11 Data Acquisition Concepts and Rules, sanitizing the target media is a critical preparatory step performed before acquiring forensic data, especially when reusing storage media or handling sensitive information. Sanitization refers to the process of securely erasing data so that it cannot be recovered using forensic techniques. This is typically achieved by overwriting the storage media with predefined patterns, such as sequential zeros and ones, or by using approved data wiping algorithms. CHFI v11 clearly distinguishes sanitization from other acquisition steps. Validating data acquisition ensures the integrity and completeness of collected evidence through hash verification and comparison, not data destruction. Acquiring volatile data focuses on capturing live information such as RAM contents, running processes, and network connections before shutdown. Planning for contingency involves preparing backups, alternate tools, and procedures in case the acquisition process fails. The scenario explicitly describes overwriting the drive to prevent any residual data recovery, which directly aligns with the CHFI v11 guideline "Sanitize the Target Media" listed under evidence handling and acquisition best practices. This step ensures privacy, prevents data leakage, and maintains legal and ethical compliance during forensic operations. Therefore, based strictly on CHFI v11 objectives and terminology, the investigator is performing sanitization of the target media, making Option D the correct and verified answer.
Topics
Community Discussion
No community discussion yet for this question.