GIAC Certified Forensic Analyst (GCFA) — Question 28

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Answer options

• A. DOS boot disk
• B. Linux Live CD
• C. Secure Authentication for EnCase (SAFE)
• D. EnCase with a hardware write blocker

Correct answer: C

Explanation

The correct answer is C, as Secure Authentication for EnCase (SAFE) provides a secure method for network imaging by ensuring that data integrity and confidentiality are maintained. Options A and B do not offer network imaging capabilities, while D, although it enhances security, does not specifically address network-based acquisition.