During a forensic investigation, an analyst must acquire digital evidence while maintaining forensic soundness. Which THREE practices should the analyst follow? (Choose three.)

Use the suspect's operating system to copy files

Power on the system to capture volatile data first

CS0-003 Incident Response and Management Practice Question

Correct answer & explanation

✓

Verify the hash of the image against the original

Write blockers prevent modification, hash verification ensures integrity, and proper documentation maintains chain of custody.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use the suspect's operating system to copy files
Why it's wrong here
Using the suspect's operating system to copy files is forensically unsound because the OS may update file access timestamps and other metadata while reading, and it does not preserve deleted files, slack space, or unallocated clusters. This approach also risks triggering malicious software or anti-forensics mechanisms on the suspect system. Proper acquisition requires booting from a trusted forensic environment and using a hardware write blocker to ensure the original data remains undisturbed.
✗
Power on the system to capture volatile data first
Why it's wrong here
Powering on a system to capture volatile data is flawed because the boot process itself changes the system state—writing to swap files, logs, and modifying metadata—and any volatile data (e.g., RAM, running processes, network connections) that existed before power-on is lost. Volatile data must be collected from a system that is already running, before it is shut down, using a live forensic toolkit. If the system is off, powering it on may degrade evidence; instead, you should preserve the drive for non-volatile acquisition and document that volatile data was already lost.
✓
Verify the hash of the image against the original
Why this is correct
Verifying the hash of the acquired image against the original evidence is a critical step because it provides cryptographic proof that the image is an exact bit-for-bit replica. Using algorithms like SHA-256, any change to even a single bit in the image produces a completely different hash, so the match confirms no data was altered during acquisition. This verification is recorded and matched against the hash of the original, establishing the integrity and authenticity of the evidence for the chain of custody and courtroom admissibility.
✓
Use a write blocker when imaging the hard drive
Why this is correct
Using a write blocker when imaging the hard drive is essential because it prevents the acquisition workstation from sending any write commands to the suspect drive, guaranteeing that the original evidence remains byte-for-byte unchanged. A hardware write blocker physically intercepts and blocks writes, while a software write blocker does the same at the driver level; both allow read-only access to the source. This safeguards the evidence from accidental modifications, OS artifacts, or malware, ensuring the image is a true and admissible copy of the original.
✓
Document every action taken during the acquisition
Why this is correct
Documenting every action taken during the acquisition is essential because it creates a complete, auditable chain of custody that allows another examiner to independently reproduce the process. Detailed notes on the tools used, timestamps, commands issued, and any anomalies observed establish the evidence's integrity and demonstrate that proper forensic protocols were followed. Without this documentation, the opposing counsel can successfully challenge the evidence's reliability, even if the technical acquisition was flawless.

CS0-003 Incident Response and Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question