Which of the following is the BEST method to gather evidence from a computer's hard drive?

The correct answer is D. Forensic imaging. Forensic imaging is the best method to gather evidence from a computer's hard drive, as it creates a bit-by-bit copy of the original drive, preserving the integrity and authenticity of the evidence. Disk duplication, disk replacement, and forensic signature are not valid methods

Submitted by renata2k· Mar 5, 2026Security Operations

Question

Options

ADisk duplication
BDisk replacement
CForensic signature
DForensic imaging

How the community answered

(46 responses)

A
4% (2)
B
2% (1)
C
2% (1)
D
91% (42)

Explanation

Forensic imaging is the best method to gather evidence from a computer's hard drive, as it creates a bit-by-bit copy of the original drive, preserving the integrity and authenticity of the evidence. Disk duplication, disk replacement, and forensic signature are not valid methods for evidence collection, as they may alter or destroy the original data on the drive.

Topics

#digital forensics#evidence collection#disk imaging#incident response

Community Discussion

No community discussion yet for this question.

Full CISSP Practice