CS0-003 · Question #486
An analyst is imaging a hard drive that was obtained from the system of an employee who is suspected of going rogue. The analyst notes that the initial hash of the evidence drive does not match the…
The correct answer is D. Evidence drive imaging was performed without a write blocker. If a write blocker was not used, or if it was improperly configured, the original evidence drive may have been altered when connected for imaging.
Question
An analyst is imaging a hard drive that was obtained from the system of an employee who is suspected of going rogue. The analyst notes that the initial hash of the evidence drive does not match the resultant hash of the imaged copy. Which of the following best describes the reason for the conflicting investigative findings?
Options
- AChain of custody was not maintained for the evidence drive.
- BLegal authorization was not obtained prior to seizing the evidence drive.
- CData integrity of the imaged drive could not be verified.
- DEvidence drive imaging was performed without a write blocker.
How the community answered
(49 responses)- A2% (1)
- B10% (5)
- C4% (2)
- D84% (41)
Explanation
If a write blocker was not used, or if it was improperly configured, the original evidence drive may have been altered when connected for imaging.
Topics
Community Discussion
No community discussion yet for this question.