A digital forensics analyst is investigating a suspected insider threat. The analyst has acquired a laptop used by the suspect. The analyst needs to obtain a forensic image of the hard drive without altering any data. The laptop is running and logged into the suspect's user account. Which of the following is the most appropriate first step for the analyst to take?

Boot the laptop from a forensic boot CD that loads a write-blocker driver and then create a forensic image.

This is incorrect because booting from any media (even a forensic CD) will cause the BIOS and potentially the running forensic OS to write data to the suspect hard drive (e.g., creating temporary files or modifying the registry) before the write-blocker driver becomes active. The drive could be altered before the write-blocker is enforced.

Perform a live acquisition of the hard drive using a network forensic tool while the system is still running.

This is incorrect because live acquisition involves interacting with the running system, which can modify file timestamps, memory, and temporary files. It also may not capture deleted or hidden data reliably. The goal is to preserve the hard drive's contents without any changes, so a live acquisition is not appropriate when a static image is required.

Ask the suspect to log off and shut down the laptop normally, then remove the hard drive and image it using a write-blocker.

This is incorrect because a normal shutdown allows the operating system to perform writes, such as flushing disk caches, writing event logs, and updating registry hives. These writes can modify or destroy potential evidence. The analyst should never rely on a normal shutdown when the device is already on.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Pull the power cord from the laptop to immediately shut down the system and prevent any further system writes. — When a suspect system is already powered on, any additional actions (including a normal shutdown) can modify data on the drive. The proper forensic procedure is to immediately cut power by unplugging the laptop or removing the battery. This preserves the state of the disk for later acquisition with a hardware write-blocker. Live acquisition (Option C) or booting a forensic CD (Option B) risk altering evidence, and a normal shutdown (Option D) allows the operating system to write temporary files and logs.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.