Forensic procedures must be followed exactly to ensure the integrity of data obtained in an investigation. When making copies of data from a machine that is being examined, which of the following should be done to ensure it is an exact duplicate?
- Perform a cyclic redundancy check using a checksum or hashing algorithm
- Change the attributes of data to make it read-only
- Do nothing — imaging software always makes an accurate image
- Open files on the original media and compare them to the copied data
Explanation: To verify that a copy of data is an exact match, it is necessary to perform a cyclic redundancy check using a checksum or hashing algorithm.
Exam with this question: Cybersecurity Pathway Final Exam Answers
Please login or Register to submit your answer