What procedure should be avoided in a digital forensics investigation?
- Make a copy of the hard drive.
- Reboot the affected system upon arrival.
- Recover deleted files.
- Secure physical access to the computer under investigation.
| Explanation & Hint:
Digital forensic investigation is the science of collecting and examining electronic evidence that can evaluate damage to a computer as a result of an electronic attack or that can recover lost information from a system in order to prosecute a criminal. To prevent tampering and alteration of the suspect data, a data forensic analysis should be conducted on a copy of the suspect computer. Furthermore, restarting a computer may change or overwrite files and inadvertently destroy evidence. |