Forensic imaging of a workstation is initiated by

A.
Booting the machine with the installed operating system.

B.
Booting the machine with an operating system diskette.

C.
Removing the hard drive to view the output of the forensic imaging software.

D.
Directing the output of the forensic imaging software to the small computer system interface
(SCSI).

Explanation:
“It is very important that the person, or people, conducting the forensics investigation is skilled in
this trade and knows what to look out for. If a person reboots the attacked system or goes around
looking at different files, it could corrupt viable evidence, change timestamps on key files, and erase
footprints the criminal may have left. One very good first step is to make a sound image of the
attacked system and perform forensic analysis on this copy. This will ensure that the evidence stays
unharmed on the original system in case some steps in the investigation actually corrupt or destroy
data. Also the memory of the system should be dumped to a file before doing any work on the
system or powering it down.” – Shon Harris All-in-one CISSP Certification Guide pg 672-673 PCMCIA
to SCSI and parallel to SCSI forensic products can be found at the following vendor.
http://www.icsforensic.com/products_cat_fr.cfm