Which of the following will invalidate the authenticity of digital evidence in a forensic investigation?
The investigator installed forensic software on the original drive that contained the evidence.
A software write blocker was used in the collection of the evidence.
The investigator collected the evidence while the machine was still powered on.
The evidence was collected from analysis of a copy of the disk data.
Submit