Multiple Choice
Creating an image of a hard drive that was seized as evidence:
A) Should be done by the user, as they are most familiar with the hard drive.
B) May only be done by trained personnel because the process has the potential to alter the original evidence.
C) May be done by anyone because it is a relatively simple procedure.
D) May only be done by computer scientists.
Correct Answer:

Verified
Correct Answer:
Verified
Q117: The following GREP expression was typed in
Q118: If a hash analysis is run on
Q119: What are the EnCase configuration .ini files
Q120: The EnCase methodology dictates that the lab
Q121: A SCSI drive is pinned as a
Q122: By default, what color does EnCase use
Q123: Search results are found in which of
Q124: The Windows 98 Start Menu has a
Q126: To undelete a file in the FAT
Q127: EnCase uses the _ to conduct a