312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

Rebecca, an experienced forensic investigator, has been asked to investigate a possible data leak at a top-tier technology firm. The leak appears to involve highly valuable confidential blueprint files. The firm’s network has been breached, and the leak seems to be continuing. A junior member of Rebecca’s team proposes shutting down the server to stop additional leaks. However, Rebecca knows that doing so would violate a key digital-forensics principle. Which principle is this?

A The Principle of Sanitizing Target Media
B The Federal Rules of Evidence
C The Principle of Data Preservation
D The Best Evidence Rule

Explanation

The Principle of Data Preservation requires investigators to avoid unnecessarily altering a system or destroying potential evidence. Shutting down a live server can eliminate volatile data such as memory contents, active network connections, and running-process information, while also changing the system’s state.

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ297

Community Discussion