PrepAway - Latest Free Exam Questions & Answers

Which of the following should have been the FIRST cours…

In the course of examining a computer system for forensic evidence, data on the suspect media were
inadvertently altered. Which of the following should have been the FIRST course of action in the investigative
process?

PrepAway - Latest Free Exam Questions & Answers

A.
Perform a backup of the suspect media to new media.

B.
Perform a bit-by-bit image of the original media source onto new media.

C.
Make a copy of all files that are relevant to the investigation.

D.
Run an error-checking program on all logical drives to ensure that there are no disk errors.


Leave a Reply