Forensic procedures must be followed exactly to ensure the integrity of data obtained in an investigation. When making copies of data from a machine that is being examined, which of the following tasks should be done to ensure it is an exact duplicate?
A.
Perform a cyclic redundancy check using a checksum or hashing algorithm.
B.
Change the attributes of data to make it read only.
C.
Open files on the original media and compare them to the copied data
D.
Do nothing. Imaging software always makes an accurate image.
Explanation:
Reference: Security + (SYBEX) page