Why should the imaging of drives always be initiated by booting the suspect drive from a previously verified forensic floppy?
A) New floppy drives bear the danger of being virus carriers.
B) A previously verified forensic floppy can detect anomalies in the drive faster.
C) Some users will configure their system to erase/modify data if third-party access is determined.
D) The verified forensic floppy can disable the write-blocking program found on most original media.

Question

Quizplus · Accepted Answer

Some users may have set up their system to erase or modify data if unauthorized third-party access is detected, so booting from a previously verified forensic floppy can prevent the execution of any malicious code that may exist on the suspect drive.

Why Should the Imaging of Drives Always Be Initiated by Booting