Why should the imaging of drives always be initiated by booting the suspect drive from a previously verified forensic floppy?
a. New floppy drives bear the danger of being virus carriers.
b. A previously verified forensic floppy can detect anomalies in the drive faster.
c. Some users will configure their system to erase/modify data if third-party access is determined.
d. The verified forensic floppy can disable the write-blocking program found on most original media.
Answer: c
You might also like to view...
________ are software systems that make using computers more convenient or users, application developers and system administrators.
a) Operating systems b) Applications c) GUIs d) None of the above.
________ on a chart can be used to point out important elements or items that need further explanation
Fill in the blank(s) with correct word
You cannot control the elements of a chart to be displayed by clicking the mouse
Indicate whether the statement is true or false
Enables you to see exactly what the report will look like when it is printed.
What will be an ideal response?