Questions and Answers
Which of the following is NOT a reason for handling original data as little as possible in forensic investigations?
To make it easier to recover deleted files
What is the recommended practice for making copies of computer hard drives in forensic investigations?
Make a bit-level copy using specialized forensic tools
Why is it important to make two copies of the drive during a forensic investigation?
To have a backup in case the original copy gets lost or damaged
What is the purpose of handling original information as little as possible in forensic investigations?
Signup and view all the answers
Which of the following tools can be used to make a bit-level copy of a computer hard drive in a forensic investigation?
Signup and view all the answers
