Forensic imaging of a workstation is initiated by

A.
Booting the machine with the installed operating system.

B.
Booting the machine with an operating system diskette.

C.
Removing the hard drive to view the output of the forensic imaging software.

D.
Directing the output of the forensic imaging software to the small computer system interface
(SCSI).

Explanation:
“It is very important that the person, or people, conducting the forensics
investigation is skilled in this trade and knows what to look out for. If a person reboots the
attacked system or goes around looking at different files, it could corrupt viable evidence, change
timestamps on key files, and erase footprints the criminal may have left. One very good first step
is to make a sound image of the attacked system and perform forensic analysis on this copy. This
will ensure that the evidence stays unharmed on the original system in case some steps in the
investigation actually corrupt or destroy data. Also the memory of the system should be dumped
to a file before doing any work on the system or powering it down.” – Shon Harris All-in-one CISSP
Certification Guide pg 672-673
PCMCIA to SCSI and parallel to SCSI forensic products can be found at the following vendor.
http://www.icsforensic.com/products_cat_fr.cfm