Certified Information Systems Auditor (CISA) — Question 575

Which of the following is MOST important when creating a forensic image of a hard drive?

Answer options

• A. Generating a content hash of the hard drive
• B. Choosing an industry-leading forensics software tool
• C. Requiring an independent third-party be present w hi le imaging
• D. Securing a backup copy of the hard drive

Correct answer: A

Explanation

Generating a content hash of the hard drive is crucial because it ensures the integrity of the data by confirming that the image is an exact replica of the original drive. While using reputable software, having a third-party present, and securing backups are important, they do not directly guarantee the fidelity of the forensic image itself, which is essential for legal and investigative purposes.