To get a forensic image copy of a hard disk,investigators first turn on the suspected computer before copying every fragment of information in the files.

Question

Quizplus · Accepted Answer

A forensic image copy is an exact copy or snapshot of the contents of an electronic medium.To get a forensic image copy of a hard disk and other computer media contents,investigators physically remove the hard disk from the computer.If the suspect computer is off,they do not turn it on,because Windows performs hundreds of changes to files.

To Get a Forensic Image Copy of a Hard Disk,investigators