Computer Forensics part 3: Investigations

Computer Forensics

Part 3: Computer Investigations

Multiple Choice

What is the most important/critical part when it comes to Computer Forensics?

• Scanning for incidents

• using many tools for forensics

• Preserving evidence and proper handling

• Identification of an incident

Multiple Choice

Why do we only use copies of the original file when using a Write-blocker in a computer forensics investigation?

• Using the copied version is easier

• The Write-blocker read hash data better.

• By using the Copy you can preserve the original evidences.

Poll

By using the Chain of custody when handling evidence this will also be following Legal hold. Do you agree or disagree?

• Agree

• Disagree