Which of the following controls would BEST help a forensic investigator prevent modifications in digital evidence?

The correct answer is A. Write-protecting media that contains evidence. Write-protecting media is a preventive control that physically or logically blocks any write operations, making it impossible to alter the evidence. This directly prevents modifications. Generating hash values (B) is a detective control - it verifies whether tampering occurred af

Submitted by helene.fr· Apr 18, 2026Protection of Information Assets

Question

Options

AWrite-protecting media that contains evidence
BGenerating hash values of evidence files on media
CCreating digital images of the media that contains evidence
DMaintaining the chain of custody for digital evidence

How the community answered

(37 responses)

A
92% (34)
B
3% (1)
D
5% (2)

Explanation

Write-protecting media is a preventive control that physically or logically blocks any write operations, making it impossible to alter the evidence. This directly prevents modifications. Generating hash values (B) is a detective control - it verifies whether tampering occurred after the fact but does not stop it. Creating digital images (C) produces working copies to preserve the original but does not prevent the original from being modified. Maintaining chain of custody (D) documents who handled the evidence but does not technically prevent modification.

Topics

#Digital Forensics#Evidence Preservation#Data Integrity#Incident Response

Community Discussion

No community discussion yet for this question.

Full CISA Practice