PrepAway - Latest Free Exam Questions & Answers

Which of the following will allow the team member to pe…

An incident response team member needs to perform a forensics examination but does not have the required
hardware. Which of the following will allow the team member to perform the examination with minimal impact to
the potential evidence?

PrepAway - Latest Free Exam Questions & Answers

A.
Using a software file recovery disc

B.
Mounting the drive in read-only mode

C.
Imaging based on order of volatility

D.
Hashing the image after capture

Explanation:
Mounting the drive in read-only mode will prevent any executable commands from being executed. This is turn
will have the least impact on potential evidence using the drive in question.

PrepAway - Latest Free Exam Questions & Answers

Leave a Reply