An image of a hard drive:
a. contains all of the data from the drive, including slack space and unallocated clusters.
b. contains irregularities that produce a different hash value than the original.
c. is a still photograph taken of the platters of a hard drive.
d. is not useful to a forensic examiner under the "best evidence" rule.
a
You might also like to view...
Discuss a form of drug abuse that is most often overlooked by law enforcement
What will be an ideal response?
When dealing with shoe impression evidence, crime scene personnel should:
a. search near or under a victim's body. b. allow unauthorized personnel into the scene. c. maintain a casual approach in searching for the evidence. d. search for the evidence after all photography is complete. e. none of the above.
Under ____ immunity, statements made by the witness may not be used in subsequent prosecutions
a. transactional b. use c. diplomatic d. legislative
A future trend is the continuing necessity to train law enforcement personnel in recognizing the indicators of terrorism and to develop effective interviewing techniques
Indicate whether the statement is true or false