Multiple Choice
When handling computer evidence, an investigator should:
A) Make any changes to the evidence that will further the investigation.
B) Avoid making any changes to the original evidence.
C) Neither a or b
D) Both a and b
Correct Answer:
Verified
Correct Answer:
Verified
Related Questions
Q26: The end of a logical file to
Q27: When can an evidence file containing a
Q28: A personal data assistant was placed in
Q29: What information in a FAT file system
Q30: In DOS acquisition mode, if a physical
Q32: The case number in an evidence file
Q33: When a non-compressed evidence file is reacquired
Q34: For an EnCase evidence file acquired with
Q35: Assume that MyNote.txt was allocated to clusters
Q36: All investigators using EnCase should run tests