A computer forensics examiner is about to conduct a forensics examination of a computer’s hard drive and anticipates that he will be cross-examined in a deposition. What should the examiner do to ensure that the image he takes of the computer’s hard drive is an exact copy of the hard drive?
a. Reconcile the numbers of files and directories on the original and copied image
b. Perform SHA-1 and MD5 checksums of the original drive and the copied image
c. Use a write blocker when making a copy of the original drive
d. Make a copy of the hard drive and perform forensics on the original
b. Perform SHA-1 and MD5 checksums of the original drive and the copied image
You might also like to view...
In a(n) ____________________ image, there are 256 shades of red, 256 shades of green, and 256 shades of blue available per pixel.
Fill in the blank(s) with the appropriate word(s).
The Input Mask Wizard can be used in the table's ________ view
A) Print Preview B) Datasheet C) Design D) Both Datasheet and Design
A(n) ________ fill is a gradual progression of colors and shades added to fill a shape
A) gradient B) bevel C) saturation D) accent
Information security is achieved through a combination of what three entities? Provide at least one example of each entity.
What will be an ideal response?