II0-001 · Question #136
Electronic evidence is easily
The correct answer is C. Changed. Electronic evidence is easily changed (C) because digital data is inherently mutable - files can be modified, metadata can be altered, and storage media can be overwritten, often without leaving obvious traces. This volatility is why chain of custody and write-blockers are…
Question
Electronic evidence is easily
Options
- ACollected
- BSeen
- CChanged
- DDocumented
How the community answered
(29 responses)- A17% (5)
- B7% (2)
- C72% (21)
- D3% (1)
Explanation
Electronic evidence is easily changed (C) because digital data is inherently mutable - files can be modified, metadata can be altered, and storage media can be overwritten, often without leaving obvious traces. This volatility is why chain of custody and write-blockers are critical in digital forensics.
- A (Collected) is incorrect - collecting electronic evidence is actually difficult, requiring specialized tools, legal authorization, and technical expertise to avoid contamination.
- B (Seen) is incorrect - electronic evidence is often invisible to the naked eye, stored as binary data on drives, memory, or in the cloud.
- D (Documented) is incorrect - proper documentation of digital evidence is a complex, methodical process requiring hashing, logging, and chain-of-custody records.
Memory tip: Think of digital evidence like a sandcastle - easy to change (a wave or a hand can alter it instantly), but hard to collect, see, and document properly without the right tools.
Community Discussion
No community discussion yet for this question.