CISA Question #337: Real Exam Question with Answer & Explanation

Question

When collecting digital data for forensic purposes, the GREATEST benefit associated with the use of imaging is that it:

Options

• Aprovides a bit-by-bit copy of original data and corrupted files for analysis
• Bprovides investigators with effective data visualizations
• Cdoes not reproduce extraneous data, such as that from residual slack data and fragments
• Dprovides real-time disk mirroring capability for preventing forensic data loss

Explanation

Forensic imaging produces an exact bit-for-bit duplicate of the entire storage medium, capturing not only active files but also deleted files, file fragments, slack space, and corrupted data - evidence that logical file-level copies would miss. This completeness is essential because forensic analysis often depends on recovering artifacts that are not visible through the normal file system. Visualization (B) is an analysis tool, not a benefit of imaging itself. Imaging intentionally does reproduce all residual data including slack space and fragments (C is therefore incorrect and the opposite of what imaging does). Real-time mirroring (D) describes a different technology and is not the defining benefit of forensic imaging.

No community discussion yet for this question.