What Is the BEST Method If an Investigator Wishes to Analyze

What is the BEST method if an investigator wishes to analyze a hard drive which may be used as evidence?

A) Leave the hard drive in place and use only verified and authenticated Operating Systems (OS) utilities to analyze the contents
B) Log into the system and immediately make a copy of all relevant files to a Write Once, Read Many (WORM) device
C) Remove the hard drive from the system and make a copy of the hard drive's contents using imaging hardware
D) Use a separate bootable device to make a copy of the hard drive before booting the system and analyzing the hard drive

Correct Answer:

Verified

Unlock this answer now
Get Access to more Verified Answers free of charge

Access For Free