Which of the following could invalidate the digital evidence collected in a forensic investigation?

The correct answer is D. A write blocker was not used when evidence was collected. The use of a write blocker is crucial in forensic investigations to ensure that digital evidence is not altered during the collection process. If a write blocker was not used, it could result in the modification of the original data, potentially invalidating the evidence and…

Submitted by lucia.co· Apr 18, 2026Protection of Information Assets

Question

Options

ALaw enforcement was not involved in evidence collection
BAnalysis was not done on the original media
CThe evidence was handled by more than one person
DA write blocker was not used when evidence was collected

How the community answered

(32 responses)

A
3% (1)
B
3% (1)
C
6% (2)
D
88% (28)

Explanation

The use of a write blocker is crucial in forensic investigations to ensure that digital evidence is not altered during the collection process. If a write blocker was not used, it could result in the modification of the original data, potentially invalidating the evidence and compromising the integrity of the forensic investigation.

Topics

#Digital Forensics#Evidence Collection#Evidence Integrity#Write Blocker

Community Discussion

No community discussion yet for this question.

Full CISA Practice