Exam 312-49v10 topic 1 question 724 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 724
Topic #: 1

Forensic Investigator Alex has to collect data from a suspect's large drive in a time-bound investigation. The court would allow him to retain the original drive. Considering these factors, what should be Alex's primary considerations to ensure a forensically sound data acquisition?

A. Using Microsoft disk compression tools and validating the data acquisition process
B. Sanitizing the target media using the (German) VSITR method and acquiring volatile data
C. Enabling write protection on the evidence media and prioritizing data acquisition based on evidentiary value
D. Utilizing lossless compression tools and creating a bit-stream copy using a reliable acquisition tool

Show Suggested Answer

Suggested Answer: D 🗳️

by aqeel1506 at July 22, 2024, 11:09 a.m.

Comments

Submit Cancel

044f354

3 months, 3 weeks ago

Selected Answer: C

Answer: C Explanation: Write protection preserves integrity; prioritization addresses time constraints (A) ❌ Compression tools risk altering metadata/authenticity (B) ❌ Sanitization destroys evidence; volatile data irrelevant to drive (C) ✅ Write-blockers prevent evidence tampering; focused collection meets time limits (D) ❌ Lossless compression unnecessary if imaging entire drive While bit-stream copies (Option D) are standard practice, prioritizing high-value evidence with write-blocked acquisition balances forensic soundness and time constraints. ----- If you agree, please UPVOTE. If you disagree, please discuss including citations. Both actions help crowdsource correct answers. When you upvote someone with a yellow "SELECTED ANSWER: " banner, your vote is added to the community vote distribution.

upvoted 1 times

...

aqeel1506

11 months, 2 weeks ago

C. Enabling write protection on the evidence media and prioritizing data acquisition based on evidentiary value

upvoted 1 times

...