Drag or tap steps into the slots.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
mediumDrag & Drop
CS0-003 Practice Question: Order the steps for proper forensic acquisition…
Order the steps for proper forensic acquisition of a hard drive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document chain of custody, connect write blocker, create forensic image, hash original drive, hash image, store securely
Forensic acquisition requires documentation, write-blocked imaging, hash verification, secure storage, and image hash verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document chain of custody, connect write blocker, create forensic image, hash original drive, hash image, store securely
Why this is correct
This sequence represents the industry-standard forensic acquisition workflow. Documenting the chain of custody must occur first to establish legal accountability before any physical interaction. Connecting a hardware write blocker ensures the source media remains unaltered during imaging, while subsequent hashing of both the source and the destination image verifies cryptographic integrity and mathematical equivalence.
- ✗
Connect write blocker, document chain of custody, create forensic image, hash original drive, hash image, store securely
Why it's wrong here
This order is flawed because physical handling of the evidence, such as connecting a write blocker, occurs before documenting the chain of custody. To withstand legal scrutiny, the chain of custody must be initiated the moment the examiner takes possession of the device, prior to any technical manipulation. Failing to document first introduces a gap in accountability that can compromise the admissibility of the evidence.
- ✗
Document chain of custody, create forensic image, connect write blocker, hash original drive, hash image, store securely
Why it's wrong here
This sequence is incorrect because attempting to create a forensic image before connecting a write blocker risks altering the metadata or contents of the original drive. Operating systems automatically mount and write to connected storage devices unless a hardware or software write blocker is actively intercepting those commands. Skipping this step first invalidates the forensic integrity of the source media.
- ✗
Document chain of custody, connect write blocker, create forensic image, hash image, hash original drive, store securely
Why it's wrong here
This order is incorrect because the original drive must be hashed prior to or during the imaging process to establish a baseline cryptographic signature. Hashing the destination image first is logically backward, as you cannot verify the copy's integrity without first knowing the exact cryptographic hash of the source. Reversing these steps undermines the verification process used to prove that no data was modified during acquisition.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.