An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

The correct answer is D. Make a forensic image of the device and create a SHA-1 hash.. Making a forensic image of the device and creating a SRA-I hash is the best step to preserve evidence, as it creates an exact copy of the device's data and verifies its integrity. A forensic image is a bit-by-bit copy of the device's storage media, which preserves all the informa

Submitted by mateo_ar· Mar 6, 2026Incident Response and Management

Question

Options

ADisable the user's network account and access to web resources.
BMake a copy of the files as a backup on the server.
CPlace a legal hold on the device and the user's network share.
DMake a forensic image of the device and create a SHA-1 hash.

How the community answered

(28 responses)

A
7% (2)
B
14% (4)
C
4% (1)
D
75% (21)

Explanation

Making a forensic image of the device and creating a SRA-I hash is the best step to preserve evidence, as it creates an exact copy of the device's data and verifies its integrity. A forensic image is a bit-by-bit copy of the device's storage media, which preserves all the information on the device, including deleted or hidden files. A SRA-I hash is a cryptographic value that is calculated from the forensic image, which can be used to prove that the image has not been altered or tampered with. The other options are not as effective as making a forensic image and creating a SRA-I hash, as they may not capture all the relevant data, or they may not provide sufficient verification of the evidence's authenticity.

Topics

#Digital forensics#Evidence preservation#Legal hold#Forensic imaging

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice