Skip to content

CS Professional · Internal and Forensic Audit · Cyber Forensics

During a suspected data-theft inquiry at an Indian firm, a forensic auditor must examine a seized laptop's hard disk. Which step should be taken first to preserve the integrity of the evidence?

The auditor should first make a bit-by-bit forensic image of the disk and verify it with a hash value, then analyse only the copy. This keeps the original unaltered and the evidence defensible. Scanning, booting or deleting files on the original would modify data.

  1. ARun a full antivirus scan on the original disk
  2. BCreate a forensic (bit-by-bit) image and work on the copy, verifying it with a hash valueCorrect
  3. CDelete temporary files to free space for analysis
  4. DBoot the laptop and browse the files to identify relevant documents

Explanation

Original media must not be altered. A bit-stream image is taken, normally through a write blocker, and a hash of the original and the image is compared. Analysis is done on the copy. Scanning, booting or deleting files on the original changes data and weakens its evidential value.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.

Practise Cyber ForensicsFree diagnostic mock

More Cyber Forensics questions