ECCouncil Computer Hacking Forensic Investigator (CHFI-v10) 312-49v10 Question # 169 Topic 17 Discussion

ECCouncil Computer Hacking Forensic Investigator (CHFI-v10) 312-49v10 Question # 169 Topic 17 Discussion

312-49v10 Exam Topic 17 Question 169 Discussion:
Question #: 169
Topic #: 17

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?


A.

A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum


B.

Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file


C.

A simple DOS copy will not include deleted files, file slack and other information


D.

There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector


Get Premium 312-49v10 Questions

Contribute your Thoughts:


Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.