Security Operations →mediumMultiple ChoiceObjective-mapped

SY0-701 Security Operations Practice Question

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

⚠ Common exam trap

Watch out — candidates often think booting the laptop or using a file manager is acceptable for a quick preview, but any write access—even seemingly harmless metadata updates—renders the evidence inadmissible under Daubert or Frye standards.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a hardware write blocker and create a bit-by-bit forensic image with hashes.

Forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Mount the drive read-write so the investigator can browse it quickly.
Why it's wrong here
Mounting the drive read-write so the investigator can browse it quickly will cause the operating system to update the access time, file system journal, and even create thumbnail caches or restore previous versions, all of which alter the original evidence. Any modification to the source media can break the forensic integrity chain and make it impossible to prove the drive was not changed after acquisition. Even simple browsing can write metadata, so a read-only acquisition method is mandatory.
✓
Use a hardware write blocker and create a bit-by-bit forensic image with hashes.
Why this is correct
This is the best practice because a hardware write blocker prevents any accidental writes to the source drive, and a bit-by-bit image captures the exact data structure for analysis. Hashing the source or image before and after acquisition provides integrity verification, which is essential when evidence may be challenged later. Together, these steps protect the original media and support chain of custody and courtroom admissibility.
✗
Copy only the user profile folders with a file manager to save time.
Why it's wrong here
Copying only the user profile folders with a file manager ignores critical forensic artifacts such as unallocated space, file slack, deleted files, and the pagefile/hibernation file, which often contain fragments of evidence. A file-manager copy also does not preserve the full file system structure or produce a verified hash of the entire disk, so it cannot authenticate that the copy faithfully represents the original media. This approach sacrifices completeness and verifiability for speed, making it unsuitable for evidentiary acquisition.
✗
Boot the laptop normally and use backup software to duplicate the disk.
Why it's wrong here
Booting the suspect laptop normally makes the operating system write to the drive—updating registry keys, event logs, user profile data, and creating temporary files—so the drive's state is no longer pristine. Backup software is designed for restoration convenience, not forensic acquisition; it typically reads files through the OS, may skip locked or system files, and does not capture deleted data or unallocated sectors in a bit-for-bit manner. The absence of a full-disk write blocker and cryptographic hash means the resulting duplicate lacks the evidentiary safeguards needed for court.

Go deeper

SY0-701 Security Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question