PrepAway - Latest Free Exam Questions & Answers

After a computer forensics investigator seizes a computer during a crime investigation, what is the next step?

After a computer forensics investigator seizes a computer during a crime investigation, what is the next step?

PrepAway - Latest Free Exam Questions & Answers

A.
Label and put it into a container, and then label the container.

B.
Dust the evidence for fingerprints.

C.
Make an image copy of the disks.

D.
Lock the evidence in the safe.

Explanation:
C: Several steps need to be followed when gathering and extracting evidence from a scene. Once a computer has been confiscated, the first thing the computer forensics team should do is make an image of the hard drive. The team will work from this image instead of the original hard drive so it stays in a pristine state and the evidence on the drive is not accidentally corrupted or modified.

2 Comments on “After a computer forensics investigator seizes a computer during a crime investigation, what is the next step?

  1. joe says:

    Several steps need to be followed when gathering and extracting evidence from a scene. Once a computer has been confiscated, the first thing the computer forensics team should do is make an image of the hard drive. The team will work from this image instead of the original hard drive so it stays in a pristine state and the evidence on the drive is not accidentally corrupted or modified.




    0



    0
  2. joe says:

    幾個步驟需要收集和從場景提取證據時,應遵循。計算機一旦被沒收,計算機取證團隊應該做的第一件事就是讓硬盤驅動器的圖像。該小組將這一形象,而不是原來的硬盤正常工作,使其保持在原始狀態和驅動器上的證據不會被意外損壞或修改。




    0



    0

Leave a Reply