A security analyst must preserve a system hard drive that was involved in a litigation request. Which of the following is the best method to ensure the data on the device is not modified?

The correct answer is A. Generate a hash value and make a backup image. Generating a hash value and making a backup image is the best method to ensure the data on the device is not modified, as it creates a verifiable copy of the original data that can be used for forensic analysis. Encrypting the device, protecting it with a password, or…

Submitted by klara.se· Mar 6, 2026Incident Response and Management

Question

Options

AGenerate a hash value and make a backup image.
BEncrypt the device to ensure confidentiality of the data.
CProtect the device with a complex password.
DPerform a memory scan dump to collect residual data

How the community answered

(36 responses)

A
83% (30)
B
8% (3)
C
6% (2)
D
3% (1)

Explanation

Generating a hash value and making a backup image is the best method to ensure the data on the device is not modified, as it creates a verifiable copy of the original data that can be used for forensic analysis. Encrypting the device, protecting it with a password, or performing a memory scan dump do not prevent the data from being altered or deleted.

Topics

#digital forensics#evidence preservation#hashing#disk imaging#chain of custody

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice