Skip to content

CS Professional · Internal and Forensic Audit · Cyber Forensics

After a data breach at Kaveri Pharma Pvt Ltd, the forensic auditor is asked to preserve the compromised laptop's hard disk. Which first step best fits the core objective of cyber forensics?

The forensic auditor should make a bit-by-bit forensic image and analyse the copy while keeping the original untouched. Cyber forensics requires preserving digital evidence integrity so it stays reliable and admissible. Reformatting, browsing or deleting files on the original would alter or destroy the evidence.

  1. AReformat the disk to remove malware and restore operations quickly
  2. BCreate a forensic bit-by-bit image and work on the copy, preserving the original unalteredCorrect
  3. CBrowse the files on the original laptop to find the suspicious documents
  4. DAsk the employee to delete personal files before handover

Explanation

Cyber forensics aims to identify, preserve, analyse and present digital evidence so that it remains admissible and its integrity is demonstrable. Imaging the disk and analysing the copy protects the original. Reformatting or browsing the original alters or destroys evidence.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.

Practise Cyber ForensicsFree diagnostic mock

More Cyber Forensics questions