CompTIA
JK0-018 · Question #456
An incident response team member needs to perform a forensics examination but does not have the required hardware. Which of the following will allow the team member to perform the examination with…
The correct answer is B. Mounting the drive in read-only mode. See the full explanation below for the reasoning.
Question
An incident response team member needs to perform a forensics examination but does not have the required hardware. Which of the following will allow the team member to perform the examination with minimal impact to the potential evidence?
Options
- AUsing a software file recovery disc
- BMounting the drive in read-only mode
- CImaging based on order of volatility
- DHashing the image after capture
How the community answered
(57 responses)- A9% (5)
- B72% (41)
- C4% (2)
- D16% (9)
Community Discussion
No community discussion yet for this question.