Which of the following is the BEST approach when conducting a forensic examination of data from an infected hard disk?

The correct answer is C. Working with an image of the infected computer's hard disk. Using an image of the infected hard disk preserves the original evidence and maintains its integrity, which is essential for forensic soundness and admissibility in legal proceedings.

Submitted by anna_se· Apr 18, 2026Information Security Incident Management

Question

Options

AWorking with a file backup from the infected computer
BWorking with the infected computer's hard disk
CWorking with an image of the infected computer's hard disk
DWorking with a rebuilt version of the infected computer's hard disk

How the community answered

(37 responses)

B
5% (2)
C
92% (34)
D
3% (1)

Explanation

Using an image of the infected hard disk preserves the original evidence and maintains its integrity, which is essential for forensic soundness and admissibility in legal proceedings.

Topics

#Digital Forensics#Evidence Preservation#Incident Response#Forensic Imaging

Community Discussion

No community discussion yet for this question.

Full CISM Practice