When handling computer evidence, an investigator should:
A) Make any changes to the evidence that will further the investigation.
B) Avoid making any changes to the original evidence.
C) Neither a or b
D) Both a and b
Correct Answer:
Verified
Q77: The EnCase evidence file is best described
Q78: Searches and bookmarks are stored in the
Q79: The first sector on a volume is
Q80: RAM is used by the computer to:
A)
Q81: All investigators using EnCase should run tests
Q83: When a file is deleted in the
Q84: Search terms are stored in what .ini
Q85: Within EnCase, what is the purpose of
Q86: What information should be obtained from the
Q87: A hash library would most accurately be
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents