Computer Hacking Forensic Investigator (CHFI v10) — Question 88

To preserve digital evidence, an investigator should ____________________.

Answer options

• A. Make two copies of each evidence item using a single imaging tool
• B. Make a single copy of each evidence item using an approved imaging tool
• C. Make two copies of each evidence item using different imaging tools
• D. Only store the original evidence item

Correct answer: C

Explanation

The correct answer is C because making two copies of each evidence item with different imaging tools ensures redundancy and reduces the risk of data loss. Option A is incorrect as using a single imaging tool does not provide sufficient backup. Option B is wrong since a single copy is not enough for preserving evidence. Option D fails to maintain any copies for analysis or verification.