nerdexam
(ISC)2

SSCP · Question #1258

Media that is the target of an investigation should be copied on to:

The correct answer is B. Forensically sterile media. Media targeted in an investigation must be copied onto forensically sterile media to prevent contamination and ensure the integrity and admissibility of the acquired evidence.

Submitted by omar99· Apr 18, 2026Incident Response and Recovery

Question

Media that is the target of an investigation should be copied on to:

Options

  • ANew media
  • BForensically sterile media
  • CReformatted and portioned media
  • DControlled and protected media

How the community answered

(45 responses)
  • A
    2% (1)
  • B
    91% (41)
  • C
    4% (2)
  • D
    2% (1)

Why each option

Media targeted in an investigation must be copied onto forensically sterile media to prevent contamination and ensure the integrity and admissibility of the acquired evidence.

ANew media

'New media' is not specific enough; new media might still contain manufacturing data or simply not be specifically prepared for forensic purposes, potentially introducing contamination.

BForensically sterile mediaCorrect

Forensically sterile media is critical because it ensures that the destination media contains no pre-existing data that could potentially alter, contaminate, or be confused with the evidence being copied from the original source. This practice maintains the integrity and authenticity of the acquired evidence, which is paramount for legal admissibility.

CReformatted and portioned media

'Reformatted and portioned media' doesn't guarantee forensic sterility, as reformatting doesn't necessarily wipe all data in a forensically sound manner, and portioning is irrelevant to sterility.

DControlled and protected media

'Controlled and protected media' describes the handling of media *after* it's been prepared, but doesn't address the initial sterility requirement for receiving forensic copies.

Concept tested: Forensic evidence acquisition best practices

Topics

#Digital Forensics#Evidence Handling#Incident Response#Media Preparation

Community Discussion

No community discussion yet for this question.

Full SSCP Practice