Study. uk . com
  1. Home
  2. All questions
  3. Question 505

CompTIA Security+ study material · question 505 of 611

Why does the forensic process separate examination from analysis?

  1. Because examination extracts relevant data while analysis draws conclusions, and conflating them invites bias
  2. Because examination requires a warrant
  3. Because they are performed by different organisations
  4. Because analysis must precede collection
Show the answer

Answer: A. Because examination extracts relevant data while analysis draws conclusions, and conflating them invites bias

Keeping them distinct means the conclusion can be re-derived from the extracted data by someone else.

Source: NIST SP 800-86 (NIST) — SP 800-86 §§ 3.2–3.3

Challenge yourself on this topic → Study as cards