Computer Hacking Forensic Investigator (CHFI) — Question 135

To preserve digital evidence, an investigator should ____________________.

Answer options

• A. Make two copies of each evidence item using a single imaging tool
• B. Make a single copy of each evidence item using an approved imaging tool
• C. Make two copies of each evidence item using different imaging tools
• D. Only store the original evidence item

Correct answer: C

Explanation

The correct answer is C because making two copies using different imaging tools helps ensure that the evidence is preserved in multiple formats, reducing the risk of data loss. Option A is incorrect as using a single tool does not provide redundancy. Option B is insufficient because a single copy does not provide adequate preservation. Option D fails to maintain any backup of the evidence.