Which of the following should Jane, a security administrator, perform before a hard drive is analyzed with forensics tools?

The correct answer is C. Capture system image. Capturing a system image (forensic imaging) is the first critical step in digital forensics. A bit-for-bit copy of the drive is created so that all analysis is performed on the copy, never the original. This preserves the integrity of the evidence and maintains the chain of custo

Security operations

Question

Options

AIdentify user habits
BDisconnect system from network
CCapture system image
DInterview witnesses

How the community answered

(25 responses)

A
4% (1)
C
88% (22)
D
8% (2)

Explanation

Capturing a system image (forensic imaging) is the first critical step in digital forensics. A bit-for-bit copy of the drive is created so that all analysis is performed on the copy, never the original. This preserves the integrity of the evidence and maintains the chain of custody. Identifying user habits (A) and interviewing witnesses (D) are investigative steps that occur at a different phase. Disconnecting the system from the network (B) is important for live acquisition scenarios, but the primary preparatory step before forensic analysis is always to image the drive first to protect the original evidence.

Topics

#digital forensics#forensic imaging#evidence handling#incident response

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice