What procedure should be avoided in a digital forensics investigation?

IT Questions BankCategory: CCNA CyberOpsWhat procedure should be avoided in a digital forensics investigation?
What procedure should be avoided in a digital forensics investigation? 1ITExamAnswers Staff asked 4 months ago
What procedure should be avoided in a digital forensics investigation?

  • Secure physical access to the computer under investigation.
  • Reboot the affected system upon arrival.
  • Make a copy of the hard drive.
  • Recover deleted files.

Explanation: Digital forensic investigation is the science of collecting and examining electronic evidence that can evaluate damage to a computer as a result of an electronic attack or that can recover lost information from a system in order to prosecute a criminal. To prevent tampering and alteration of the suspect data, a data forensic analysis should be conducted on a copy of the suspect computer. Furthermore, restarting a computer may change or overwrite files and inadvertently destroy evidence.

More Questions: CCNA Cyber Ops Chapter 12 Exam Answers


Related Articles