Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Security

During an internal investigation at an Indian company, the IT team must copy the hard disk of a suspect employee's laptop for later analysis. Which practice best preserves the evidential value of the original disk?

The best practice is to create a bit-by-bit forensic image with a write blocker and analyse only the copy. This captures deleted and hidden data and leaves the original disk unchanged, which protects the integrity and admissibility of the evidence.

  1. ARun the analysis directly on the original disk so no data is lost in copying
  2. BCreate a bit-by-bit forensic image using a write blocker and work only on the copyCorrect
  3. CCopy only the visible user documents to a pen drive
  4. DDelete temporary files first so that the analysis is faster

Explanation

A forensic image made through a write blocker captures all data, including deleted and slack-space content, without altering the original. Working on the original or copying only selected files risks modifying or missing evidence, and deleting files destroys it.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Security shows your real accuracy, how long you take and where you lose marks.

Practise Cyber SecurityFree diagnostic mock

More Cyber Security questions