During data acquisition, you should typically work on a duplicated copy rather than the original to preserve evidence.

During data acquisition, you should typically work on a duplicated copy rather than the original to preserve evidence.

• A. True
• B. False
• C. Only in emergencies
• D. It doesn't matter

Answer: (A)

Preserving evidentiary integrity during data acquisition means you should work on a duplicated copy of the media rather than the original. The standard approach is to create a forensically sound bit-for-bit image of the source, use a write blocker to prevent any writes to the original, and verify the copy with cryptographic hashes (like MD5 or SHA-256) to confirm it’s an exact replica. All analysis then occurs on the copy, while the original is kept untouched and securely stored with documented chain of custody. This ensures the evidence remains unaltered, allows repeatable and auditable examination, and supports admissibility in court. It’s not limited to emergencies—touching the original would risk modifying data and undermining the investigation.

Preserving evidentiary integrity during data acquisition means you should work on a duplicated copy of the media rather than the original. The standard approach is to create a forensically sound bit-for-bit image of the source, use a write blocker to prevent any writes to the original, and verify the copy with cryptographic hashes (like MD5 or SHA-256) to confirm it’s an exact replica. All analysis then occurs on the copy, while the original is kept untouched and securely stored with documented chain of custody. This ensures the evidence remains unaltered, allows repeatable and auditable examination, and supports admissibility in court. It’s not limited to emergencies—touching the original would risk modifying data and undermining the investigation.