What Is the BEST Method If an Investigator Wishes to Analyze

question 196

Multiple Choice

What is the BEST method if an investigator wishes to analyze a hard drive which may be used as evidence?

• A) Leave the hard drive in place and use only verified and authenticated Operating Systems (OS) utilities to analyze the contents
• B) Log into the system and immediately make a copy of all relevant files to a Write Once, Read Many (WORM) device
• C) Remove the hard drive from the system and make a copy of the hard drive's contents using imaging hardware
• D) Use a separate bootable device to make a copy of the hard drive before booting the system and analyzing the hard drive

---

Definitions:

Detective

A police officer or private investigator specializing in solving crimes and gathering evidence.

Trespass To Chattels

Direct, intentional interference with another’s rights to possess his personal property.

Wrongful Interference

An intentional act by one party to disrupt a contractual or business relationship between other parties, causing harm.

Conversion

An intentional tort that involves the unauthorized taking or use of someone else's personal property.