Computer Hacking Forensic Investigator (CHFI v10) — Question 585

Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

Answer options

• A. Two
• B. One
• C. Three
• D. Four

Correct answer: A

Explanation

Using two data acquisition tools is a standard practice in computer forensics to ensure the integrity and reliability of the evidence. This method allows for cross-verification of the copies made, reducing the risk of data loss. The other options suggest using either one or more than two tools, which could compromise the redundancy and verification needed in forensic investigations.