Multiple Choice
Creating an image of a hard drive that was seized as evidence:
A) May be done by anyone because it is a relatively simple procedure.
B) May only be done by trained personnel because the process has the potential to alter the original evidence.
C) May only be done by computer scientists.
D) Should be done by the user, as they are most familiar with the hard drive.
Correct Answer:

Verified
Correct Answer:
Verified
Q74: The case file should be archived with
Q75: A case file can contain _ hard
Q76: To undelete a file in the FAT
Q77: Which of the following aspects of the
Q78: EnCase marks a file as overwritten when
Q80: The EnCase case file can be best
Q81: Will EnCase allow a user to write
Q82: In the FAT file system, the size
Q83: Within EnCase, what is purpose of the
Q84: By default, what color does EnCase use