Which of the Following Needs to Be Performed During a Forensics

question 276

Multiple Choice

Which of the following needs to be performed during a forensics investigation to ensure the data contained in a drive image has not been compromised?

• A) Follow the proper chain of custody procedures.
• B) Compare the image hash to the original hash.
• C) Ensure a legal hold has been placed on the image.
• D) Verify the time offset on the image file.

---

Definitions:

Entry Barriers

Obstacles that make it difficult for new competitors to enter a market or industry.

Substitute Products

Products that can serve as replacements for one another; when the price of one increases, the demand for the substitute is likely to increase.

Herfindahl Index

A measure of market concentration used to evaluate the level of competition within an industry, calculated by summing the squares of the market shares of all firms in the industry.

Four-Firm Concentration Ratio

A measure of market concentration that indicates the combined market share of the four largest firms in an industry.