After a forensics investigator seizes and transports the computer, what is the next step?

Question

Options

• ALock the evidence in a safe
• BMake an image copy of the storage media (hard drive, CD, diskettes)
• CDust the evidence for fingerprints
• DLabel and place it into a container and label the container

• A
  13% (4)
• B
  73% (22)
• C
  10% (3)
• D
  3% (1)

Explanation

Making an image copy of the storage media (B) must happen immediately after seizure and transport because all forensic analysis is performed on the copy - never the original. This preserves the integrity of the evidence and ensures that any accidental modification during analysis doesn't corrupt the original; hash values (MD5/SHA) are used to verify the copy matches the original bit-for-bit.

Why the distractors are wrong:

• A (Lock in a safe) - securing evidence is important, but it comes after imaging, not before; you need the forensic copy first.
• C (Dust for fingerprints) - physical forensics (fingerprinting) is a separate investigation lane and doesn't precede digital evidence preservation.
• D (Label and container) - labeling and chain-of-custody packaging should have occurred at the scene before transport, making this an earlier step, not the next one.

Memory tip: Think "copy before you touch." The forensic workflow follows the order: seize → transport → image → analyze. Imaging comes right after transport because you want a pristine working copy before anything else happens to the evidence.

No community discussion yet for this question.