Question

During an enterprise incident response engagement, a forensic analyst must acquire a bit-for-bit image of a suspect employee's laptop SSD that has already been powered off. The evidence may be used in future litigation. Which combination of actions BEST preserves the forensic integrity and admissibility of the acquired image?

Accepted Answer

Remove the drive and image it through a hardware write blocker, generate a cryptographic hash of both source and image, and document a signed chain-of-custody form

Answer

Boot the laptop into its normal OS, copy the user's profile folder to an evidence share, and record the file hashes afterward

Answer

Create a logical backup using the built-in OS backup utility and store it on an encrypted external drive labeled with the case number

Answer

Image the running system over the network using a remote agent, then immediately shut the laptop down to prevent tampering