CS0-003 · Question #367
Which of the following evidence collection methods is most likely to be acceptable in court cases?
The correct answer is D. Providing a bit-level image of the hard drive. A bit-level image is a forensic-grade copy that preserves all data on a disk, including unallocated space, deleted files, and metadata. This is the most legally defensible form of digital evidence collection, as it ensures that no potential evidence is missed.
Question
Which of the following evidence collection methods is most likely to be acceptable in court cases?
Options
- ACopying all access files at the time of the incident
- BCreating a file-level archive of all files
- CProviding a full system backup inventory
- DProviding a bit-level image of the hard drive
How the community answered
(36 responses)- A3% (1)
- B3% (1)
- D94% (34)
Explanation
A bit-level image is a forensic-grade copy that preserves all data on a disk, including unallocated space, deleted files, and metadata. This is the most legally defensible form of digital evidence collection, as it ensures that no potential evidence is missed.
Topics
Community Discussion
No community discussion yet for this question.