exam questions

Exam CS0-003 All Questions

View all questions & answers for the CS0-003 exam

Exam CS0-003 topic 1 question 266 discussion

Actual exam question from CompTIA's CS0-003
Question #: 266
Topic #: 1
[All CS0-003 Questions]

Which of the following evidence collection methods is most likely to be acceptable in court cases?

  • A. Copying all access files at the time of the incident
  • B. Creating a file-level archive of all files
  • C. Providing a full system backup inventory
  • D. Providing a bit-level image of the hard drive
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
TurboMor
Highly Voted 8 months, 2 weeks ago
Selected Answer: D
A bit-level image is the best option.
upvoted 5 times
...
luiiizsoares
Most Recent 6 months, 3 weeks ago
Selected Answer: D
D. Providing a bit-level image of the hard drive A bit-level image (or forensic image) captures an exact, sector-by-sector copy of the entire hard drive, preserving all data, including deleted files, unallocated space, and system metadata. This method ensures the integrity of the evidence and allows for proper forensic analysis while maintaining the chain of custody, making it highly acceptable in legal proceedings. It is considered the most reliable method for evidence collection because it captures all aspects of the system in its state at the time of collection.
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago