Compression of collected evidence can't be utilized because:

Question

Options

• ACompression modifies the original evidence
• BComplete drive imaging requires every bit to be identical, there's compression can't be utilized
• CCompression can be utilized, but only if CRC on compression sequences are utilized
• DCompression of original evidence can be utilized

• A
  9% (2)
• B
  13% (3)
• C
  4% (1)
• D
  74% (17)

Explanation

Option D is the correct answer because it exposes the question itself as containing a false premise - compression can be utilized when handling forensic evidence. Modern forensic tools (e.g., EnCase's E01/EWF format, FTK Imager) support compressed forensic images while preserving integrity through cryptographic hashing (MD5/SHA), allowing investigators to store evidence efficiently without compromising admissibility.

Why the distractors fail:

• A is wrong because compression creates a copy; the original physical media is never touched or altered during acquisition.
• B is wrong because compressed forensic formats still capture every bit of source data - the compression is applied to the image, not the source, and integrity is verified via hash comparison before and after.
• C is partially on the right track (integrity verification matters) but is wrong to claim CRC on compression sequences is the only acceptable method; standard hash verification on the full image is the accepted practice.

Memory tip: Think of it like zipping a document - the zip file doesn't modify the original file, it just stores the data more efficiently. Forensic compression works the same way: compress the copy, hash everything, and the original evidence stays untouched and verifiable.

No community discussion yet for this question.