Question

A forensic analyst must acquire the contents of a suspect's laptop hard drive for a potential litigation case. The analyst needs to ensure that the acquired image is an exact, verifiable copy and that the original evidence remains unaltered during the process. Which combination of practices BEST satisfies these requirements?

Accepted Answer

Attach the drive through a hardware write-blocker, create a bit-for-bit image, and generate/compare cryptographic hashes of the source and image

Answer

Boot the suspect laptop normally and copy the relevant files to an external drive, then note the copy timestamp

Answer

Run antivirus on the source drive first, then perform a logical file copy and zip the results for storage

Answer

Encrypt the source drive with a new key before imaging so the evidence cannot be tampered with afterward