Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?
A) A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
B) Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
C) A simple DOS copy will not include deleted files, file slack and other information
D) There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector
Correct Answer:
Verified
Q488: Which of the following refers to the
Q489: An Employee is suspected of stealing proprietary
Q490: When examining a hard disk without a
Q491: The use of warning banners helps a
Q492: You are working in the security Department
Q494: A state department site was recently attacked
Q495: When investigating a Windows System, it is
Q496: In Microsoft file structures, sectors are grouped
Q497: When reviewing web logs, you see an
Q498: This is original file structure database that
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents