Which of the following is not true of a forensics investigation?

A.
The crime scene should be modified as necessary.

B.
A file copy tool may not recover all data areas of the device that are necessary for investigation.

C.
Contamination of the crime scene may not negate derived evidence, but it should still be documented.

D.
Only individuals with knowledge of basic crime scene analysis should have access to the crime scene.

Explanation:
A: The principles of criminalistics are included in the forensic investigation process. They are identification of the crime scene, protection of the
environment against contamination and loss of evidence, identification of evidence and potential sources of evidence, and collection of evidence. In regard
to minimizing the degree of contamination, it is important to understand that it is impossible not to change a crime scenebe it physical or digital. The key
is to minimize changes and document what you did and why, and how the crime scene was affected.
B is incorrect because it is true that a file copy tool may not recover all data areas of the device necessary for investigation. During the examination and
analysis process of a forensics investigation, it is critical that the investigator works from an image that contains all of the data from the original disk. It must
be a bit-level copy, sector by sector, to capture deleted files, slack spaces, and unallocated clusters. These types of images can be created through the use
of specialized tools such as FTK Imager, DD, EnCase, and Safeback, or the -dd Unix utility.
C is incorrect because it is true that if a crime scene becomes contaminated, that should be documented. While it may not negate the derived evidence,
it will make investigating the crime and providing useful evidence for court more challenging. Whether the crime scene is physical or digital, it is important
to control who comes in contact with the evidence of the crime to ensure its integrity.
D is incorrect because the statement is true. Only authorized individuals should be allowed to access the crime scene, and these individuals should have
knowledge of basic crime scene analysis. Other measures to protect the crime scene include documenting who is at the crime scene and the last
individuals to interact with the system. In court, the integrity of the evidence may be in question if there are too many people milling around.