Why Should the Imaging of Drives Always Be Initiated by Booting

question 7

Multiple Choice

Why should the imaging of drives always be initiated by booting the suspect drive from a previously verified forensic floppy?

• A) New floppy drives bear the danger of being virus carriers.
• B) A previously verified forensic floppy can detect anomalies in the drive faster.
• C) Some users will configure their system to erase/modify data if third-party access is determined.
• D) The verified forensic floppy can disable the write-blocking program found on most original media.

---

Definitions:

Economic Loss

The monetary value of the decrease in welfare or trade-offs resulting from an economic transaction or decision, beyond just the physical loss.

Product Differentiation

The strategy of setting a product or service apart from others in the industry to enhance its attractiveness to a specific target group.

Allocative Efficiency

A condition of distributing resources in which improving the situation of one person necessitates the detriment of another.

Long-Run Equilibrium

A state in which all factors of production can be adjusted, markets clear, and no economic agents have the incentive to change their behavior.