Which of the following is not a part of data acquisition forensics Investigation?

Which of the following is not a part of data acquisition forensics Investigation?

• A. Permit only authorized personnel to access
• B. Protect the evidence from extremes in temperature
• C. Work on the original storage medium not on the duplicated copy
• D. Disable all remote access to the system

Answer: (C)

During data acquisition in forensics, the goal is to capture a precise, unaltered copy of the evidence and then analyze that copy, not the original media itself. This is done to preserve the integrity of the source and maintain admissibility in court. A forensic image is created and often verified with cryptographic hashes, and a write blocker is used to ensure no accidental writes modify the original during the process. Working on the original storage medium contradicts this approach because any interaction can change data, timestamps, or other evidence, compromising integrity and the ability to prove a clean chain of custody. The other safeguards—restricting access to authorized personnel, protecting the evidence from extreme temperatures, and isolating the system from remote access—are standard practices to preserve evidence and prevent tampering during collection and analysis.

During data acquisition in forensics, the goal is to capture a precise, unaltered copy of the evidence and then analyze that copy, not the original media itself. This is done to preserve the integrity of the source and maintain admissibility in court. A forensic image is created and often verified with cryptographic hashes, and a write blocker is used to ensure no accidental writes modify the original during the process.

Working on the original storage medium contradicts this approach because any interaction can change data, timestamps, or other evidence, compromising integrity and the ability to prove a clean chain of custody. The other safeguards—restricting access to authorized personnel, protecting the evidence from extreme temperatures, and isolating the system from remote access—are standard practices to preserve evidence and prevent tampering during collection and analysis.